Merge staging-next into staging

2024-08-14 12:01:50 +00:00
parent 85f8ce656f d22bd4ff5a
commit 5254a09f0d
70 changed files with 4710 additions and 3091 deletions
@@ -20,8 +20,6 @@
 - `hardware.display` is a new module implementing workarounds for misbehaving monitors
  through setting up custom EDID files and forcing kernel/framebuffer modes.

- NixOS now has support for *automatic boot assessment* (see [here](https://systemd.io/AUTOMATIC_BOOT_ASSESSMENT/)) for detailed description of the feature) for `systemd-boot` users. Available as [boot.loader.systemd-boot.bootCounting](#opt-boot.loader.systemd-boot.bootCounting.enable).
-
 - A new display-manager `services.displayManager.ly` was added.
  It is a tui based replacement of sddm and lightdm for window manager users.
  Users can use it by `services.displayManager.ly.enable` and config it by
@@ -54,7 +54,10 @@ in
            WEBUI_AUTH = "False";
          }
        '';
-        description = "Extra environment variables for Open-WebUI";
+        description = ''
+          Extra environment variables for Open-WebUI.
+          For more details see https://docs.openwebui.com/getting-started/env-configuration/
+        '';
      };

      openFirewall = lib.mkOption {
@@ -1,14 +1,10 @@
-{ config, lib, extendModules, noUserModules, ... }:
+{ config, lib, pkgs, extendModules, noUserModules, ... }:

 let
  inherit (lib)
-    attrNames
    concatStringsSep
-    filter
-    length
    mapAttrs
    mapAttrsToList
-    match
    mkOption
    types
    ;
@@ -77,19 +73,6 @@ in
  };

  config = {
-    assertions = [(
-      let
-        invalidNames = filter (name: match "[[:alnum:]_]+" name == null) (attrNames config.specialisation);
-      in
-      {
-        assertion = length invalidNames == 0;
-        message = ''
-          Specialisation names can only contain alphanumeric characters and underscores
-          Invalid specialisation names: ${concatStringsSep ", " invalidNames}
-        '';
-      }
-    )];
-
    system.systemBuilderCommands = ''
      mkdir $out/specialisation
      ${concatStringsSep "\n"
@@ -1,38 +0,0 @@
-# Automatic boot assessment with systemd-boot {#sec-automatic-boot-assessment}
-
-## Overview {#sec-automatic-boot-assessment-overview}
-
-Automatic boot assessment (or boot-counting) is a feature of `systemd-boot` that allows for automatically detecting invalid boot entries.
-When the feature is active, each boot entry has an associated counter with a user defined number of trials. Whenever `systemd-boot` boots an entry, its counter is decreased by one, ultimately being marked as *bad* if the counter ever reaches zero. However, if an entry is successfully booted, systemd will permanently mark it as *good* and remove the counter altogether. Whenever an entry is marked as *bad*, it is sorted last in the `systemd-boot` menu.
-A complete explanation of how that feature works can be found [here](https://systemd.io/AUTOMATIC_BOOT_ASSESSMENT/).
-
-## Enabling the feature {#sec-automatic-boot-assessment-enable}
-
-The feature can be enabled by toogling the [boot.loader.systemd-boot.bootCounting](#opt-boot.loader.systemd-boot.bootCounting.enable) option.
-
-## The boot-complete.target unit {#sec-automatic-boot-assessment-boot-complete-target}
-
-A *successful boot* for an entry is defined in terms of the `boot-complete.target` synchronisation point. It is up to the user to schedule all necessary units for the machine to be considered successfully booted before that synchronisation point.
-For example, if you are running `docker` on a machine and you want to be sure that a *good* entry is an entry where docker is started successfully.
-A configuration for that NixOS machine could look like that:
-
-```
-boot.loader.systemd-boot.bootCounting.enable = true;
-services.docker.enable = true;
-
-systemd.services.docker = {
-  before = [ "boot-complete.target" ];
-  wantedBy = [ "boot-complete.target" ];
-  unitConfig.FailureAction = "reboot";
-};
-```
-
-The systemd service type must be of type `notify` or `oneshot` for systemd to dectect the startup error properly.
-
-## Interaction with specialisations {#sec-automatic-boot-assessment-specialisations}
-
-When the boot-counting feature is enabled, `systemd-boot` will still try the boot entries in the same order as they are displayed in the boot menu. This means that the specialisations of a given generation will be tried directly after that generation, but that behavior is customizable with the [boot.loader.systemd-boot.sortKey](#opt-boot.loader.systemd-boot.sortKey) option.
-
-## Limitations {#sec-automatic-boot-assessment-limitations}
-
-This feature has to be used wisely to not risk any data integrity issues. Rollbacking into past generations can sometimes be dangerous, for example if some of the services may have undefined behaviors in the presence of unrecognized data migrations from future versions of themselves.
@@ -12,9 +12,8 @@ import subprocess
 import sys
 import warnings
 import json
-from typing import NamedTuple, Any, Type
+from typing import NamedTuple, Any
 from dataclasses import dataclass
-from pathlib import Path

 # These values will be replaced with actual values during the package build
 EFI_SYS_MOUNT_POINT = "@efiSysMountPoint@"
@@ -34,8 +33,6 @@ CAN_TOUCH_EFI_VARIABLES = "@canTouchEfiVariables@"
 GRACEFUL = "@graceful@"
 COPY_EXTRA_FILES = "@copyExtraFiles@"
 CHECK_MOUNTPOINTS = "@checkMountpoints@"
-BOOT_COUNTING_TRIES = "@bootCountingTries@"
-BOOT_COUNTING = "@bootCounting@" == "True"

@dataclass
 class BootSpec:
@@ -51,108 +48,6 @@ class BootSpec:
    devicetree: str | None = None  # noqa: N815
    initrdSecrets: str | None = None  # noqa: N815

-@dataclass
-class Entry:
-    profile: str | None
-    generation_number: int
-    specialisation: str | None
-
-    @classmethod
-    def from_path(cls: Type["Entry"], path: Path) -> "Entry":
-        filename = path.name
-        # Matching nixos-$profile-generation-*.conf
-        rex_profile = re.compile(r"^nixos-(.*)-generation-.*\.conf$")
-        # Matching nixos*-generation-$number*.conf
-        rex_generation = re.compile(r"^nixos.*-generation-([0-9]+).*\.conf$")
-        # Matching nixos*-generation-$number-specialisation-$specialisation_name*.conf
-        rex_specialisation = re.compile(r"^nixos.*-generation-([0-9]+)-specialisation-([a-zA-Z0-9_]+).*\.conf$")
-        profile = rex_profile.sub(r"\1", filename) if rex_profile.match(filename) else None
-        specialisation = rex_specialisation.sub(r"\2", filename) if rex_specialisation.match(filename) else None
-        try:
-            generation_number = int(rex_generation.sub(r"\1", filename))
-        except ValueError:
-            raise
-        return cls(profile, generation_number, specialisation)
-
-@dataclass
-class DiskEntry:
-    entry: Entry
-    default: bool
-    counters: str | None
-    title: str | None
-    description: str | None
-    kernel: str
-    initrd: str
-    kernel_params: str | None
-    machine_id: str | None
-    sort_key: str
-    devicetree: str | None
-
-    @classmethod
-    def from_path(cls: Type["DiskEntry"], path: Path) -> "DiskEntry":
-        entry = Entry.from_path(path)
-        data = path.read_text().splitlines()
-        if '' in data:
-            data.remove('')
-        entry_map = dict(lines.split(' ', 1) for lines in data)
-        assert "linux" in entry_map
-        assert "initrd" in entry_map
-        filename = path.name
-        # Matching nixos*-generation-*$counters.conf
-        rex_counters = re.compile(r"^nixos.*-generation-.*(\+\d(-\d)?)\.conf$")
-        counters = rex_counters.sub(r"\1", filename) if rex_counters.match(filename) else None
-        disk_entry = cls(
-            entry=entry,
-            default=(entry_map.get("sort-key") == "default"),
-            counters=counters,
-            title=entry_map.get("title"),
-            description=entry_map.get("version"),
-            kernel=entry_map["linux"],
-            initrd=entry_map["initrd"],
-            kernel_params=entry_map.get("options"),
-            machine_id=entry_map.get("machine-id"),
-            sort_key=entry_map.get("sort_key", "nixos"),
-            devicetree=entry_map.get("devicetree"),
-        )
-        return disk_entry
-
-    def write(self, sorted_first: str) -> None:
-        # Compute a sort-key sorted before sorted_first
-        # This will compute something like: nixos -> nixor-default to make sure we come before other nixos entries,
-        # while allowing users users can pre-pend their own entries before.
-        default_sort_key = sorted_first[:-1] + chr(ord(sorted_first[-1])-1) + "-default"
-        tmp_path = self.path.with_suffix(".tmp")
-        with tmp_path.open('w') as f:
-            # We use "sort-key" to sort the default generation first.
-            # The "default" string is sorted before "non-default" (alphabetically)
-            boot_entry = [
-                f"title {self.title}" if self.title is not None else None,
-                f"version {self.description}" if self.description is not None else None,
-                f"linux {self.kernel}",
-                f"initrd  {self.initrd}",
-                f"options {self.kernel_params}" if self.kernel_params is not None else None,
-                f"machine-id {self.machine_id}" if self.machine_id is not None else None,
-                f"sort-key {default_sort_key if self.default else self.sort_key}",
-                f"devicetree {self.devicetree}" if self.devicetree is not None else None,
-            ]
-
-            f.write("\n".join(filter(None, boot_entry)))
-            f.flush()
-            os.fsync(f.fileno())
-        tmp_path.rename(self.path)
-
-
-    @property
-    def path(self) -> Path:
-        pieces = [
-            "nixos",
-            self.entry.profile or None,
-            "generation",
-            str(self.entry.generation_number),
-            f"specialisation-{self.entry.specialisation}" if self.entry.specialisation else None,
-        ]
-        prefix = "-".join(p for p in pieces if p)
-        return Path(f"{BOOT_MOUNT_POINT}/loader/entries/{prefix}{self.counters if self.counters else ''}.conf")

 libc = ctypes.CDLL("libc.so.6")

@@ -185,13 +80,29 @@ def system_dir(profile: str | None, generation: int, specialisation: str | None)
    else:
        return d

-def write_loader_conf(profile: str | None) -> None:
-    with open(f"{EFI_SYS_MOUNT_POINT}/loader/loader.conf.tmp", 'w') as f:
+BOOT_ENTRY = """title {title}
+sort-key {sort_key}
+version Generation {generation} {description}
+linux {kernel}
+initrd {initrd}
+options {kernel_params}
+"""
+
+def generation_conf_filename(profile: str | None, generation: int, specialisation: str | None) -> str:
+    pieces = [
+        "nixos",
+        profile or None,
+        "generation",
+        str(generation),
+        f"specialisation-{specialisation}" if specialisation else None,
+    ]
+    return "-".join(p for p in pieces if p) + ".conf"
+
+
+def write_loader_conf(profile: str | None, generation: int, specialisation: str | None) -> None:
+    with open(f"{LOADER_CONF}.tmp", 'w') as f:
        f.write(f"timeout {TIMEOUT}\n")
-        if profile:
-            f.write("default nixos-%s-generation-*\n" % profile)
-        else:
-            f.write("default nixos-generation-*\n")
+        f.write("default %s\n" % generation_conf_filename(profile, generation, specialisation))
        if not EDITOR:
            f.write("editor 0\n")
        if REBOOT_FOR_BITLOCKER:
@@ -201,19 +112,6 @@ def write_loader_conf(profile: str | None) -> None:
        os.fsync(f.fileno())
    os.rename(f"{LOADER_CONF}.tmp", LOADER_CONF)

-def scan_entries() -> list[DiskEntry]:
-    """
-    Scan all entries in $ESP/loader/entries/*
-    Does not support Type 2 entries as we do not support them for now.
-    Returns a generator of Entry.
-    """
-    entries = []
-    for path in Path(f"{EFI_SYS_MOUNT_POINT}/loader/entries/").glob("nixos*-generation-[1-9]*.conf"):
-        try:
-            entries.append(DiskEntry.from_path(path))
-        except ValueError:
-            continue
-    return entries

 def get_bootspec(profile: str | None, generation: int) -> BootSpec:
    system_directory = system_dir(profile, generation, None)
@@ -258,14 +156,8 @@ def copy_from_file(file: str, dry_run: bool = False) -> str:
        copy_if_not_exists(store_file_path, f"{BOOT_MOUNT_POINT}{efi_file_path}")
    return efi_file_path

-def write_entry(profile: str | None,
-                generation: int,
-                specialisation: str | None,
-                machine_id: str,
-                bootspec: BootSpec,
-                entries: list[DiskEntry],
-                sorted_first: str,
-                current: bool) -> None:
+def write_entry(profile: str | None, generation: int, specialisation: str | None,
+                machine_id: str, bootspec: BootSpec, current: bool) -> None:
    if specialisation:
        bootspec = bootspec.specialisations[specialisation]
    kernel = copy_from_file(bootspec.kernel)
@@ -289,33 +181,31 @@ def write_entry(profile: str | None,
                  f'for "{title} - Configuration {generation}", an older generation', file=sys.stderr)
            print("note: this is normal after having removed "
                  "or renamed a file in `boot.initrd.secrets`", file=sys.stderr)
+    entry_file = f"{BOOT_MOUNT_POINT}/loader/entries/%s" % (
+        generation_conf_filename(profile, generation, specialisation))
+    tmp_path = "%s.tmp" % (entry_file)
    kernel_params = "init=%s " % bootspec.init
+
    kernel_params = kernel_params + " ".join(bootspec.kernelParams)
    build_time = int(os.path.getctime(system_dir(profile, generation, specialisation)))
    build_date = datetime.datetime.fromtimestamp(build_time).strftime('%F')
-    counters = f"+{BOOT_COUNTING_TRIES}" if BOOT_COUNTING else ""
-    entry = Entry(profile, generation, specialisation)
-    # We check if the entry we are writing is already on disk
-    # and we update its "default entry" status
-    for entry_on_disk in entries:
-        if entry == entry_on_disk.entry:
-            entry_on_disk.default = current
-            entry_on_disk.write(sorted_first)
-            return

-    DiskEntry(
-        entry=entry,
-        title=title,
-        kernel=kernel,
-        initrd=initrd,
-        counters=counters,
-        kernel_params=kernel_params,
-        machine_id=machine_id,
-        description=f"Generation {generation} {bootspec.label}, built on {build_date}",
-        sort_key=bootspec.sortKey,
-        devicetree=devicetree,
-        default=current
-    ).write(sorted_first)
+    with open(tmp_path, 'w') as f:
+        f.write(BOOT_ENTRY.format(title=title,
+                    sort_key=bootspec.sortKey,
+                    generation=generation,
+                    kernel=kernel,
+                    initrd=initrd,
+                    kernel_params=kernel_params,
+                    description=f"{bootspec.label}, built on {build_date}"))
+        if machine_id is not None:
+            f.write("machine-id %s\n" % machine_id)
+        if devicetree is not None:
+            f.write("devicetree %s\n" % devicetree)
+        f.flush()
+        os.fsync(f.fileno())
+    os.rename(tmp_path, entry_file)
+

 def get_generations(profile: str | None = None) -> list[SystemIdentifier]:
    gen_list = run(
@@ -343,19 +233,30 @@ def get_generations(profile: str | None = None) -> list[SystemIdentifier]:
    return configurations[-configurationLimit:]


-def remove_old_entries(gens: list[SystemIdentifier], disk_entries: list[DiskEntry]) -> None:
+def remove_old_entries(gens: list[SystemIdentifier]) -> None:
+    rex_profile = re.compile(r"^" + re.escape(BOOT_MOUNT_POINT) + r"/loader/entries/nixos-(.*)-generation-.*\.conf$")
+    rex_generation = re.compile(r"^" + re.escape(BOOT_MOUNT_POINT) + r"/loader/entries/nixos.*-generation-([0-9]+)(-specialisation-.*)?\.conf$")
    known_paths = []
    for gen in gens:
        bootspec = get_bootspec(gen.profile, gen.generation)
        known_paths.append(copy_from_file(bootspec.kernel, True))
        known_paths.append(copy_from_file(bootspec.initrd, True))
-    for disk_entry in disk_entries:
-        if (disk_entry.entry.profile, disk_entry.entry.generation_number, None) not in gens:
-            os.unlink(disk_entry.path)
-    for path in glob.iglob(f"{EFI_SYS_MOUNT_POINT}/efi/nixos/*"):
+    for path in glob.iglob(f"{BOOT_MOUNT_POINT}/loader/entries/nixos*-generation-[1-9]*.conf"):
+        if rex_profile.match(path):
+            prof = rex_profile.sub(r"\1", path)
+        else:
+            prof = None
+        try:
+            gen_number = int(rex_generation.sub(r"\1", path))
+        except ValueError:
+            continue
+        if (prof, gen_number, None) not in gens:
+            os.unlink(path)
+    for path in glob.iglob(f"{BOOT_MOUNT_POINT}/{NIXOS_DIR}/*"):
        if path not in known_paths and not os.path.isdir(path):
            os.unlink(path)

+
 def cleanup_esp() -> None:
    for path in glob.iglob(f"{EFI_SYS_MOUNT_POINT}/loader/entries/nixos*"):
        os.unlink(path)
@@ -374,7 +275,7 @@ def get_profiles() -> list[str]:
 def install_bootloader(args: argparse.Namespace) -> None:
    try:
        with open("/etc/machine-id") as machine_file:
-            machine_id = machine_file.readlines()[0].strip()
+            machine_id = machine_file.readlines()[0]
    except IOError as e:
        if e.errno != errno.ENOENT:
            raise
@@ -458,32 +359,18 @@ def install_bootloader(args: argparse.Namespace) -> None:
    gens = get_generations()
    for profile in get_profiles():
        gens += get_generations(profile)
-    entries = scan_entries()
-    remove_old_entries(gens, entries)
-    # Compute the sort-key that will be sorted first.
-    sorted_first = ""
-    for gen in gens:
-        try:
-            bootspec = get_bootspec(gen.profile, gen.generation)
-            if bootspec.sortKey < sorted_first or sorted_first == "":
-                sorted_first = bootspec.sortKey
-        except OSError as e:
-            # See https://github.com/NixOS/nixpkgs/issues/114552
-            if e.errno == errno.EINVAL:
-                profile = f"profile '{gen.profile}'" if gen.profile else "default profile"
-                print("ignoring {} in the list of boot entries because of the following error:\n{}".format(profile, e), file=sys.stderr)
-            else:
-                raise e
+
+    remove_old_entries(gens)

    for gen in gens:
        try:
            bootspec = get_bootspec(gen.profile, gen.generation)
            is_default = os.path.dirname(bootspec.init) == args.default_config
-            write_entry(*gen, machine_id, bootspec, entries, sorted_first, current=is_default)
+            write_entry(*gen, machine_id, bootspec, current=is_default)
            for specialisation in bootspec.specialisations.keys():
-                write_entry(gen.profile, gen.generation, specialisation, machine_id, bootspec, entries, sorted_first, current=(is_default and bootspec.specialisations[specialisation].sortKey == bootspec.sortKey))
+                write_entry(gen.profile, gen.generation, specialisation, machine_id, bootspec, current=is_default)
            if is_default:
-                write_loader_conf(gen.profile)
+                write_loader_conf(*gen)
        except OSError as e:
            # See https://github.com/NixOS/nixpkgs/issues/114552
            if e.errno == errno.EINVAL:
@@ -80,8 +80,6 @@ let
        ${pkgs.coreutils}/bin/install -D $empty_file "${bootMountPoint}/${nixosDir}/.extra-files/loader/entries/"${escapeShellArg n}
      '') cfg.extraEntries)}
    '';
-    bootCountingTries = cfg.bootCounting.tries;
-    bootCounting = if cfg.bootCounting.enable then "True" else "False";
  };

  finalSystemdBootBuilder = pkgs.writeScript "install-systemd-boot.sh" ''
@@ -91,10 +89,7 @@ let
  '';
 in {

-  meta = {
-    maintainers = with lib.maintainers; [ julienmalka ];
-    doc = ./boot-counting.md;
-  };
+  meta.maintainers = with lib.maintainers; [ julienmalka ];

  imports =
    [ (mkRenamedOptionModule [ "boot" "loader" "gummiboot" "enable" ] [ "boot" "loader" "systemd-boot" "enable" ])
@@ -333,15 +328,6 @@ in {
      '';
    };

-    bootCounting = {
-      enable = mkEnableOption "automatic boot assessment";
-      tries = mkOption {
-        default = 3;
-        type = types.int;
-        description = "number of tries each entry should start with";
-      };
-    };
-
    rebootForBitlocker = mkOption {
      default = false;

@@ -107,10 +107,6 @@ let
      "systemd-rfkill.service"
      "systemd-rfkill.socket"

-      # Boot counting
-      "boot-complete.target"
-    ] ++ lib.optional config.boot.loader.systemd-boot.bootCounting.enable "systemd-bless-boot.service" ++ [
-
      # Hibernate / suspend.
      "hibernate.target"
      "suspend.target"
@@ -71,32 +71,6 @@ import ./make-test-python.nix ({ pkgs, ... }: {
        }
      '';

-      wrongConfigFile = pkgs.writeText "configuration.nix" ''
-        { lib, pkgs, ... }: {
-          imports = [
-            ./hardware-configuration.nix
-            <nixpkgs/nixos/modules/testing/test-instrumentation.nix>
-          ];
-
-          boot.loader.grub = {
-            enable = true;
-            device = "/dev/vda";
-            forceInstall = true;
-          };
-
-          documentation.enable = false;
-
-          environment.systemPackages = [
-            (pkgs.writeShellScriptBin "parent" "")
-          ];
-
-          specialisation.foo-bar = {
-            inheritParentConfig = true;
-
-            configuration = { ... }: { };
-          };
-        }
-      '';
    in
    ''
      machine.start()
@@ -142,12 +116,5 @@ import ./make-test-python.nix ({ pkgs, ... }: {
      with subtest("Make sure nonsense command combinations are forbidden"):
          machine.fail("nixos-rebuild boot --specialisation foo")
          machine.fail("nixos-rebuild boot -c foo")
-
-      machine.copy_from_host(
-          "${wrongConfigFile}",
-          "/etc/nixos/configuration.nix",
-      )
-      with subtest("Make sure that invalid specialisation names are rejected"):
-          machine.fail("nixos-rebuild switch")
    '';
 })
@@ -13,8 +13,6 @@ let
    boot.loader.systemd-boot.enable = true;
    boot.loader.efi.canTouchEfiVariables = true;
    environment.systemPackages = [ pkgs.efibootmgr ];
-    # Needed for machine-id to be persisted between reboots
-    environment.etc."machine-id".text = "00000000000000000000000000000000";
  };

  commonXbootldr = { config, lib, pkgs, ... }:
@@ -83,7 +81,7 @@ let
    os.environ['NIX_DISK_IMAGE'] = tmp_disk_image.name
  '';
 in
-rec {
+{
  basic = makeTest {
    name = "systemd-boot";
    meta.maintainers = with pkgs.lib.maintainers; [ danielfullmer julienmalka ];
@@ -95,8 +93,7 @@ rec {
      machine.wait_for_unit("multi-user.target")

      machine.succeed("test -e /boot/loader/entries/nixos-generation-1.conf")
-      # our sort-key will uses r to sort before nixos
-      machine.succeed("grep 'sort-key nixor-default' /boot/loader/entries/nixos-generation-1.conf")
+      machine.succeed("grep 'sort-key nixos' /boot/loader/entries/nixos-generation-1.conf")

      # Ensure we actually booted using systemd-boot
      # Magic number is the vendor UUID used by systemd-boot.
@@ -434,15 +431,15 @@ rec {
    '';
  };

-  garbage-collect-entry = { withBootCounting ? false, ... }: makeTest {
-    name = "systemd-boot-garbage-collect-entry" + optionalString withBootCounting "-with-boot-counting";
+  garbage-collect-entry = makeTest {
+    name = "systemd-boot-garbage-collect-entry";
    meta.maintainers = with pkgs.lib.maintainers; [ julienmalka ];

    nodes = {
      inherit common;
      machine = { pkgs, nodes, ... }: {
        imports = [ common ];
-        boot.loader.systemd-boot.bootCounting.enable = withBootCounting;
+
        # These are configs for different nodes, but we'll use them here in `machine`
        system.extraDependencies = [
          nodes.common.system.build.toplevel
@@ -457,12 +454,8 @@ rec {
      ''
        machine.succeed("nix-env -p /nix/var/nix/profiles/system --set ${baseSystem}")
        machine.succeed("nix-env -p /nix/var/nix/profiles/system --delete-generations 1")
-        # At this point generation 1 has already been marked as good so we reintroduce counters artificially
-        ${optionalString withBootCounting ''
-        machine.succeed("mv /boot/loader/entries/nixos-generation-1.conf /boot/loader/entries/nixos-generation-1+3.conf")
-        ''}
        machine.succeed("${baseSystem}/bin/switch-to-configuration boot")
-        machine.fail("test -e /boot/loader/entries/nixos-generation-1*")
+        machine.fail("test -e /boot/loader/entries/nixos-generation-1.conf")
        machine.succeed("test -e /boot/loader/entries/nixos-generation-2.conf")
      '';
  };
@@ -482,138 +475,4 @@ rec {
        machine.wait_for_unit("multi-user.target")
      '';
    };
-
-  # Check that we are booting the default entry and not the generation with largest version number
-  defaultEntry = { withBootCounting ? false, ... }: makeTest {
-    name = "systemd-boot-default-entry" + optionalString withBootCounting "-with-boot-counting";
-    meta.maintainers = with pkgs.lib.maintainers; [ julienmalka ];
-
-    nodes = {
-      machine = { pkgs, lib, nodes, ... }: {
-        imports = [ common ];
-        system.extraDependencies = [ nodes.other_machine.system.build.toplevel ];
-        boot.loader.systemd-boot.bootCounting.enable = withBootCounting;
-      };
-
-      other_machine = { pkgs, lib, ... }: {
-        imports = [ common ];
-        boot.loader.systemd-boot.bootCounting.enable = withBootCounting;
-        environment.systemPackages = [ pkgs.hello ];
-      };
-    };
-    testScript = { nodes, ... }:
-      let
-        orig = nodes.machine.system.build.toplevel;
-        other = nodes.other_machine.system.build.toplevel;
-      in
-      ''
-        orig = "${orig}"
-        other = "${other}"
-
-        def check_current_system(system_path):
-            machine.succeed(f'test $(readlink -f /run/current-system) = "{system_path}"')
-
-        check_current_system(orig)
-
-        # Switch to other configuration
-        machine.succeed("nix-env -p /nix/var/nix/profiles/system --set ${other}")
-        machine.succeed(f"{other}/bin/switch-to-configuration boot")
-        # Rollback, default entry is now generation 1
-        machine.succeed("nix-env -p /nix/var/nix/profiles/system --rollback")
-        machine.succeed(f"{orig}/bin/switch-to-configuration boot")
-        machine.shutdown()
-        machine.start()
-        machine.wait_for_unit("multi-user.target")
-        # Check that we booted generation 1 (default)
-        # even though generation 2 comes first in alphabetical order
-        check_current_system(orig)
-      '';
-  };
-
-
-  bootCounting =
-    let
-      baseConfig = { pkgs, lib, ... }: {
-        imports = [ common ];
-        boot.loader.systemd-boot.bootCounting.enable = true;
-        boot.loader.systemd-boot.bootCounting.tries = 2;
-      };
-    in
-    makeTest {
-      name = "systemd-boot-counting";
-      meta.maintainers = with pkgs.lib.maintainers; [ julienmalka ];
-
-      nodes = {
-        machine = { pkgs, lib, nodes, ... }: {
-          imports = [ baseConfig ];
-          system.extraDependencies = [ nodes.bad_machine.system.build.toplevel ];
-        };
-
-        bad_machine = { pkgs, lib, ... }: {
-          imports = [ baseConfig ];
-
-          systemd.services."failing" = {
-            script = "exit 1";
-            requiredBy = [ "boot-complete.target" ];
-            before = [ "boot-complete.target" ];
-            serviceConfig.Type = "oneshot";
-          };
-        };
-      };
-      testScript = { nodes, ... }:
-        let
-          orig = nodes.machine.system.build.toplevel;
-          bad = nodes.bad_machine.system.build.toplevel;
-        in
-        ''
-          orig = "${orig}"
-          bad = "${bad}"
-
-          def check_current_system(system_path):
-              machine.succeed(f'test $(readlink -f /run/current-system) = "{system_path}"')
-
-          # Ensure we booted using an entry with counters enabled
-          machine.succeed(
-              "test -e /sys/firmware/efi/efivars/LoaderBootCountPath-4a67b082-0a4c-41cf-b6c7-440b29bb8c4f"
-          )
-
-          # systemd-bless-boot should have already removed the "+2" suffix from the boot entry
-          machine.wait_for_unit("systemd-bless-boot.service")
-          machine.succeed("test -e /boot/loader/entries/nixos-generation-1.conf")
-          check_current_system(orig)
-
-          # Switch to bad configuration
-          machine.succeed("nix-env -p /nix/var/nix/profiles/system --set ${bad}")
-          machine.succeed(f"{bad}/bin/switch-to-configuration boot")
-
-          # Ensure new bootloader entry has initialized counter
-          machine.succeed("test -e /boot/loader/entries/nixos-generation-1.conf")
-          machine.succeed("test -e /boot/loader/entries/nixos-generation-2+2.conf")
-          machine.shutdown()
-
-          machine.start()
-          machine.wait_for_unit("multi-user.target")
-          check_current_system(bad)
-          machine.succeed("test -e /boot/loader/entries/nixos-generation-1.conf")
-          machine.succeed("test -e /boot/loader/entries/nixos-generation-2+1-1.conf")
-          machine.shutdown()
-
-          machine.start()
-          machine.wait_for_unit("multi-user.target")
-          check_current_system(bad)
-          machine.succeed("test -e /boot/loader/entries/nixos-generation-1.conf")
-          machine.succeed("test -e /boot/loader/entries/nixos-generation-2+0-2.conf")
-          machine.shutdown()
-
-          # Should boot back into original configuration
-          machine.start()
-          check_current_system(orig)
-          machine.wait_for_unit("multi-user.target")
-          machine.succeed("test -e /boot/loader/entries/nixos-generation-1.conf")
-          machine.succeed("test -e /boot/loader/entries/nixos-generation-2+0-2.conf")
-          machine.shutdown()
-        '';
-    };
-  defaultEntryWithBootCounting = defaultEntry { withBootCounting = true; };
-  garbageCollectEntryWithBootCounting = garbage-collect-entry { withBootCounting = true; };
 }
@@ -2843,9 +2843,9 @@ dependencies = [

 [[package]]
 name = "time"
-version = "0.3.34"
+version = "0.3.36"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8248b6521bb14bc45b4067159b9b6ad792e2d6d754d6c41fb50e29fefe38749"
+checksum = "5dfd88e563464686c916c7e46e623e520ddc6d79fa6641390f2e3fa86e83e885"
 dependencies = [
 "deranged",
 "itoa",
@@ -2864,9 +2864,9 @@ checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3"

 [[package]]
 name = "time-macros"
-version = "0.2.17"
+version = "0.2.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ba3a3ef41e6672a2f0f001392bb5dcd3ff0a9992d618ca761a11c3121547774"
+checksum = "3f252a68540fde3a3877aeea552b832b40ab9a69e318efd078774a01ddee1ccf"
 dependencies = [
 "num-conv",
 "time-core",
@@ -11,13 +11,13 @@
 }:

 let
-  version = "0.54";
+  version = "0.54-unstable-2024-08-11";

  src = fetchFromGitHub {
    owner = "liuchengxu";
    repo = "vim-clap";
-    rev = "v${version}";
-    hash = "sha256-rhCum59GCIAwdi5QgSaPfrALelAIMncNetu81i53Q8c=";
+    rev = "3e8d001f5c9be10e4bb680a1d409326902c96c10";
+    hash = "sha256-7bgbKYjJX2Tfprb69/imyvhsCsurrmPWBXVVLX+ZMnM=";
  };

  meta = with lib; {
@@ -1,12 +1,32 @@
-{ lib, stdenv, fetchFromGitLab, fetchurl
-, boost, cmake, ffmpeg, wrapQtAppsHook, qtbase, qtx11extras
-, qttools, qtxmlpatterns, qtsvg, gdal, gfortran, libXt, makeWrapper
-, ninja, mpi, python3, tbb, libGLU, libGL
-, withDocs ? true
+{
+  lib,
+  stdenv,
+  fetchFromGitLab,
+  fetchurl,
+  boost,
+  cmake,
+  ffmpeg,
+  wrapQtAppsHook,
+  qtbase,
+  qtx11extras,
+  qttools,
+  qtxmlpatterns,
+  qtsvg,
+  gdal,
+  gfortran,
+  libXt,
+  makeWrapper,
+  ninja,
+  mpi,
+  python3,
+  tbb,
+  libGLU,
+  libGL,
+  withDocs ? true,
 }:

 let
-  version = "5.12.0";
+  version = "5.12.1";

  docFiles = [
    (fetchurl {
@@ -26,7 +46,8 @@ let
    })
  ];

-in stdenv.mkDerivation rec {
+in
+stdenv.mkDerivation rec {
  pname = "paraview";
  inherit version;

@@ -35,7 +56,7 @@ in stdenv.mkDerivation rec {
    owner = "paraview";
    repo = "paraview";
    rev = "v${version}";
-    hash = "sha256-PAD48IlOU39TosjfTiDz7IjEeYEP/7F75M+8dYBIUxI=";
+    hash = "sha256-jbqMqj3D7LTwQ+hHIPscCHw4TfY/BR2HuVmMYom2+dA=";
    fetchSubmodules = true;
  };

@@ -86,7 +107,10 @@ in stdenv.mkDerivation rec {
    qtsvg
  ];

-  postInstall = let docDir = "$out/share/paraview-${lib.versions.majorMinor version}/doc"; in
+  postInstall =
+    let
+      docDir = "$out/share/paraview-${lib.versions.majorMinor version}/doc";
+    in
    lib.optionalString withDocs ''
      mkdir -p ${docDir};
      for docFile in ${lib.concatStringsSep " " docFiles}; do
@@ -95,14 +119,21 @@ in stdenv.mkDerivation rec {
    '';

  propagatedBuildInputs = [
-    (python3.withPackages (ps: with ps; [ numpy matplotlib mpi4py ]))
+    (python3.withPackages (
+      ps: with ps; [
+        numpy
+        matplotlib
+        mpi4py
+      ]
+    ))
  ];

-  meta = with lib; {
-    homepage = "https://www.paraview.org/";
+  meta = {
+    homepage = "https://www.paraview.org";
    description = "3D Data analysis and visualization application";
-    license = licenses.bsd3;
-    maintainers = with maintainers; [ guibert ];
-    platforms = platforms.linux;
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ guibert ];
+    changelog = "https://www.kitware.com/paraview-${lib.concatStringsSep "-" (lib.versions.splitVersion version)}-release-notes";
+    platforms = lib.platforms.linux;
  };
 }
@@ -2,7 +2,6 @@
 , lib
 , fetchFromGitHub
 , makeDesktopItem
-, python3
 , python3Packages
 , netcdf
 , glew
@@ -50,7 +49,7 @@ python3Packages.buildPythonApplication rec {

  postPatch = ''
    substituteInPlace setup.py \
-      --replace-fail "self.install_libbase" '"${placeholder "out"}/${python3.sitePackages}"'
+      --replace-fail "self.install_libbase" '"${placeholder "out"}/${python3Packages.python.sitePackages}"'
  '';

  build-system = [
@@ -63,10 +62,10 @@ python3Packages.buildPythonApplication rec {

  postInstall = with python3Packages; ''
    wrapProgram $out/bin/pymol \
-      --prefix PYTHONPATH : ${lib.makeSearchPathOutput "lib" python3.sitePackages [ pyqt5 pyqt5.pyqt5-sip ]}
+      --prefix PYTHONPATH : ${lib.makeSearchPathOutput "lib" python3Packages.python.sitePackages [ pyqt5 pyqt5.pyqt5-sip ]}

    mkdir -p "$out/share/icons/"
-    ln -s $out/${python3.sitePackages}/pymol/pymol_path/data/pymol/icons/icon2.svg "$out/share/icons/pymol.svg"
+    ln -s $out/${python3Packages.python.sitePackages}/pymol/pymol_path/data/pymol/icons/icon2.svg "$out/share/icons/pymol.svg"
  '' + lib.optionalString stdenv.hostPlatform.isLinux ''
    cp -r "${desktopItem}/share/applications/" "$out/share/"
  '';
@@ -26,7 +26,7 @@
 }:

 let
-  version = "1.17.2";
+  version = "1.18.1";

  # build stimuli file for PGO build and the script to generate it
  # independently of the foot's build, so we can cache the result
@@ -98,7 +98,7 @@ stdenv.mkDerivation {
    owner = "dnkl";
    repo = "foot";
    rev = version;
-    hash = "sha256-p+qaWHBrUn6YpNyAmQf6XoQyO3degHP5oMN53/9gIr4=";
+    hash = "sha256:15s7fbkibvq53flf5yy9ad37y53pl83rcnjwlnfh96a4s5mj6v5d";
  };

  separateDebugInfo = true;
@@ -156,6 +156,8 @@ stdenv.mkDerivation {
    "-Dcustom-terminfo-install-location=${terminfoDir}"
    # Install systemd user units for foot-server
    "-Dsystemd-units-dir=${placeholder "out"}/lib/systemd/user"
+    # Especially -Wunused-command-line-argument is a problem with clang
+    "-Dwerror=false"
  ];

  # build and run binary generating PGO profiles,
@@ -13,21 +13,21 @@
 let
  # josh-ui requires javascript dependencies, haven't tried to figure it out yet
  cargoFlags = [ "--workspace" "--exclude" "josh-ui" ];
+  version = "24.08.14";
 in

-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage {
  pname = "josh";
-  version = "23.12.04";
-  JOSH_VERSION = "r${version}";
+  inherit version;

  src = fetchFromGitHub {
    owner = "esrlabs";
    repo = "josh";
-    rev = JOSH_VERSION;
-    sha256 = "10fspcafqnv6if5c1h8z9pf9140jvvlrch88w62wsg4w2vhaii0v";
+    rev = "v${version}";
+    hash = "sha256-6U1nhERpPQAVgQm6xwRlHIhslYBLd65DomuGn5yRiSs=";
  };

-  cargoHash = "sha256-g4/Z3QUFBeWlqhnZ2VhmdAjya4A+vwXQa7QYZ+CgG8g=";
+  cargoHash = "sha256-s6+Bd4ucwUinrcbjNvlDsf9LhWc/U9SAvBRW7JAmxVA=";

  nativeBuildInputs = [
    pkg-config
@@ -44,6 +44,9 @@ rustPlatform.buildRustPackage rec {
  cargoBuildFlags = cargoFlags;
  cargoTestFlags = cargoFlags;

+  # used to teach josh itself about its version number
+  env.JOSH_VERSION = "r${version}";
+
  postInstall = ''
    wrapProgram "$out/bin/josh-proxy" --prefix PATH : "${git}/bin"
  '';
@@ -1,4 +1,6 @@
-{ lib, stdenv, fetchFromGitHub, rustPlatform, pkg-config, dtc, openssl }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch
+, rustPlatform, pkg-config, dtc, openssl
+}:

 rustPlatform.buildRustPackage rec {
  pname = "cloud-hypervisor";
@@ -11,6 +13,14 @@ rustPlatform.buildRustPackage rec {
    hash = "sha256-zrMJGdbOukNbzmcTuIcHlwAbJvTzhz53dc4TO/Fplb4=";
  };

+  patches = [
+    (fetchpatch {
+      name = "ub.patch";
+      url = "https://github.com/cloud-hypervisor/cloud-hypervisor/commit/02f146fef81c4aa4a7ef3555c176d3b533158d7a.patch";
+      hash = "sha256-g9WcGJy8Q+Bc0egDfoQVSVfKqyXa8vkIZk+aYQyFuy8=";
+    })
+  ];
+
  cargoLock = {
    lockFile = ./Cargo.lock;
    outputHashes = {
@@ -7,91 +7,23 @@

 rustPlatform.buildRustPackage rec {
  pname = "bugstalker";
-  version = "0.1.4";
+  version = "0.2.2";

  src = fetchFromGitHub {
    owner = "godzie44";
    repo = "BugStalker";
    rev = "v${version}";
-    hash = "sha256-16bmvz6/t8H8Sx/32l+fp3QqP5lwi0o1Q9KqDHqF22U=";
+    hash = "sha256-JacRt+zNwL7hdpdh5h9Mxztqi47f5eUbcZyx6ct/5Bc=";
  };

-  cargoHash = "sha256-kp0GZ0cM57BMpH/8lhxevnBuJhUSH0rtxP4B/9fXYiU=";
+  cargoHash = "sha256-ljT7Dl9553sfZBqTe6gT3iYPH+D1Jp9ZsyGVQGOekxw=";

  buildInputs = [ libunwind ];

  nativeBuildInputs = [ pkg-config ];

-  # Tests which require access to example source code fail in the sandbox. I
-  # haven't managed to figure out how to fix this.
-  checkFlags = [
-    "--skip=breakpoints::test_breakpoint_at_fn_with_monomorphization"
-    "--skip=breakpoints::test_breakpoint_at_line_with_monomorphization"
-    "--skip=breakpoints::test_brkpt_on_function"
-    "--skip=breakpoints::test_brkpt_on_function_name_collision"
-    "--skip=breakpoints::test_brkpt_on_line"
-    "--skip=breakpoints::test_brkpt_on_line2"
-    "--skip=breakpoints::test_brkpt_on_line_collision"
-    "--skip=breakpoints::test_debugee_run"
-    "--skip=breakpoints::test_deferred_breakpoint"
-    "--skip=breakpoints::test_multiple_brkpt_on_addr"
-    "--skip=breakpoints::test_set_breakpoint_idempotence"
-    "--skip=io::test_backtrace"
-    "--skip=io::test_read_register_write"
-    "--skip=io::test_read_value_u64"
-    "--skip=multithreaded::test_multithreaded_app_running"
-    "--skip=multithreaded::test_multithreaded_backtrace"
-    "--skip=multithreaded::test_multithreaded_breakpoints"
-    "--skip=multithreaded::test_multithreaded_trace"
-    "--skip=signal::test_signal_stop_multi_thread"
-    "--skip=signal::test_signal_stop_multi_thread_multiple_signal"
-    "--skip=signal::test_signal_stop_single_thread"
-    "--skip=signal::test_transparent_signals"
-    "--skip=steps::test_step_into"
-    "--skip=steps::test_step_into_recursion"
-    "--skip=steps::test_step_out"
-    "--skip=steps::test_step_over"
-    "--skip=steps::test_step_over_inline_code"
-    "--skip=steps::test_step_over_on_fn_decl"
-    "--skip=symbol::test_symbol"
-    "--skip=test_debugger_disassembler"
-    "--skip=test_debugger_graceful_shutdown"
-    "--skip=test_debugger_graceful_shutdown_multithread"
-    "--skip=test_frame_cfa"
-    "--skip=test_registers"
-    "--skip=variables::test_arguments"
-    "--skip=variables::test_btree_map"
-    "--skip=variables::test_cast_pointers"
-    "--skip=variables::test_cell"
-    "--skip=variables::test_circular_ref_types"
-    "--skip=variables::test_lexical_blocks"
-    "--skip=variables::test_read_array"
-    "--skip=variables::test_read_atomic"
-    "--skip=variables::test_read_btree_set"
-    "--skip=variables::test_read_closures"
-    "--skip=variables::test_read_enum"
-    "--skip=variables::test_read_hashmap"
-    "--skip=variables::test_read_hashset"
-    "--skip=variables::test_read_only_local_variables"
-    "--skip=variables::test_read_pointers"
-    "--skip=variables::test_read_scalar_variables"
-    "--skip=variables::test_read_scalar_variables_at_place"
-    "--skip=variables::test_read_static_in_fn_variable"
-    "--skip=variables::test_read_static_variables"
-    "--skip=variables::test_read_static_variables_different_modules"
-    "--skip=variables::test_read_strings"
-    "--skip=variables::test_read_struct"
-    "--skip=variables::test_read_tls_variables"
-    "--skip=variables::test_read_type_alias"
-    "--skip=variables::test_read_union"
-    "--skip=variables::test_read_uuid"
-    "--skip=variables::test_read_vec_and_slice"
-    "--skip=variables::test_read_vec_deque"
-    "--skip=variables::test_shared_ptr"
-    "--skip=variables::test_slice_operator"
-    "--skip=variables::test_type_parameters"
-    "--skip=variables::test_zst_types"
-  ];
+  # Tests require rustup.
+  doCheck = false;

  meta = {
    description = "Rust debugger for Linux x86-64";
@@ -30,7 +30,7 @@
  #sundials,
  superscs,
  spral,
-  swig,
+  swig4,
  tinyxml-2,
  withUnfree ? false,
 }:
@@ -96,6 +96,17 @@ stdenv.mkDerivation (finalAttrs: {
      substituteInPlace swig/python/CMakeLists.txt --replace-fail \
        "if (SWIG_IMPORT)" \
        "if (NOT SWIG_IMPORT)"
+    ''
+    + lib.optionalString stdenv.isDarwin ''
+      # this is only printing stuff, and is not defined on all CPU
+      substituteInPlace casadi/interfaces/hpipm/hpipm_runtime.hpp --replace-fail \
+        "d_print_exp_tran_mat" \
+        "//d_print_exp_tran_mat"
+
+      # fix missing symbols
+      substituteInPlace cmake/FindCLANG.cmake --replace-fail \
+        "clangBasic)" \
+        "clangBasic clangASTMatchers clangSupport)"
    '';

  nativeBuildInputs = [
@@ -128,7 +139,7 @@ stdenv.mkDerivation (finalAttrs: {
      #sundials
      superscs
      spral
-      swig
+      swig4
      tinyxml-2
    ]
    ++ lib.optionals withUnfree [
@@ -138,11 +149,15 @@ stdenv.mkDerivation (finalAttrs: {
    ++ lib.optionals pythonSupport [
      python3Packages.numpy
      python3Packages.python
-    ];
+    ]
+    ++ lib.optionals stdenv.isDarwin [ llvmPackages_17.openmp ];

  cmakeFlags = [
    (lib.cmakeBool "WITH_PYTHON" pythonSupport)
    (lib.cmakeBool "WITH_PYTHON3" pythonSupport)
+    # We don't mind always setting this cmake variable, it will be read only if
+    # pythonSupport is enabled.
+    "-DPYTHON_PREFIX=${placeholder "out"}/${python3Packages.python.sitePackages}"
    (lib.cmakeBool "WITH_JSON" false)
    (lib.cmakeBool "WITH_INSTALL_INTERNAL_HEADERS" true)
    (lib.cmakeBool "INSTALL_INTERNAL_HEADERS" true)
@@ -189,11 +204,6 @@ stdenv.mkDerivation (finalAttrs: {
    #(lib.cmakeBool "WITH_ALPAQA" true)  # this requires casadi...
  ];

-  # I don't know how to pass absolute $out path from cmakeFlags
-  postConfigure = lib.optionalString pythonSupport ''
-    cmake -DPYTHON_PREFIX=$out/${python3Packages.python.sitePackages} ..
-  '';
-
  doCheck = true;

  meta = {
@@ -201,5 +211,6 @@ stdenv.mkDerivation (finalAttrs: {
    homepage = "https://github.com/casadi/casadi";
    license = lib.licenses.lgpl3Only;
    maintainers = with lib.maintainers; [ nim65s ];
+    platforms = lib.platforms.all;
  };
 })
@@ -31,7 +31,7 @@ let
 in
 python.pkgs.buildPythonApplication rec {
  pname = "charmcraft";
-  version = "3.1.1";
+  version = "3.1.2";

  pyproject = true;

@@ -39,7 +39,7 @@ python.pkgs.buildPythonApplication rec {
    owner = "canonical";
    repo = "charmcraft";
    rev = "refs/tags/${version}";
-    hash = "sha256-oxNbAIf7ltdDYkGJj29zvNDNXT6vt1jWaIqHJoMr7gU=";
+    hash = "sha256-Qi2ZtAYgQlKj77QPovcT3RrPwAlEwaFyoJ0MAq4EETE=";
  };

  postPatch = ''
@@ -6,11 +6,11 @@
 }:
 appimageTools.wrapType2 rec {
  pname = "dopamine";
-  version = "3.0.0-preview.29";
+  version = "3.0.0-preview.31";

  src = fetchurl {
    url = "https://github.com/digimezzo/dopamine/releases/download/v${version}/Dopamine-${version}.AppImage";
-    hash = "sha256-VBqnqDMLDC5XJIXygENWagXllq1P090EtumADDd2I8w=";
+    hash = "sha256-NWDk4OOaven1FgSkvKCNY078xkwR+Tp4kUASh/rIbzo=";
  };

  extraInstallCommands =
@@ -24,16 +24,16 @@ let
 in
 buildRustPackage rec {
  pname = "fedimint";
-  version = "0.3.3";
+  version = "0.4.1";

  src = fetchFromGitHub {
    owner = "fedimint";
    repo = "fedimint";
    rev = "v${version}";
-    hash = "sha256-0SsIuMCdsZdYSRA1yT1axMe6+p+tIpXyN71V+1B7jYc=";
+    hash = "sha256-udQxFfLkAysDtD6P3TsW0xEcENA77l+GaDUSnkIBGXo=";
  };

-  cargoHash = "sha256-nQvEcgNOT04H5OgMHfN1713A4nbEaKK2KDx9E3qxcbM=";
+  cargoHash = "sha256-w1yQOEoumyam4JsDarAQffTs8Ype4VUyGJ0vgJfuHaU=";

  nativeBuildInputs = [
    protobuf
@@ -62,13 +62,9 @@ buildRustPackage rec {
    keepPattern=''${keepPattern:1}
    find "$out/bin" -maxdepth 1 -type f | grep -Ev "(''${keepPattern})" | xargs rm -f

-    # fix the upstream name
-    mv $out/bin/recoverytool $out/bin/fedimint-recoverytool
-
-
    cp -a $releaseDir/fedimint-cli  $fedimintCli/bin/
    cp -a $releaseDir/fedimint-dbtool  $fedimintCli/bin/
-    cp -a $releaseDir/recoverytool  $fedimintCli/bin/fedimint-recoverytool
+    cp -a $releaseDir/fedimint-recoverytool  $fedimintCli/bin/

    cp -a $releaseDir/fedimintd  $fedimint/bin/

@@ -5,13 +5,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  name = "filterpath";
-  version = "1.0.1";
+  version = "1.0.2";

  src = fetchFromGitHub {
    owner = "Sigmanificient";
    repo = "filterpath";
    rev = finalAttrs.version;
-    hash = "sha256-vagIImWQQRigMYW12lw+Eg37JJ2yO/V5jq4wD3q4yy8=";
+    hash = "sha256-9rHooXgpvfNNeWxS8UF6hmb8vCz+xKABrJNd+AgKFJs=";
  };

  makeFlags = [
@@ -28,13 +28,13 @@ let
  pieBuild = stdenv.hostPlatform.isMusl;
 in buildGoModule rec {
  pname = "frankenphp";
-  version = "1.2.3";
+  version = "1.2.4";

  src = fetchFromGitHub {
    owner = "dunglas";
    repo = "frankenphp";
    rev = "v${version}";
-    hash = "sha256-P4yBguD3DXYUe70/mKmvzFnsBXQOH4APaAZZle8lFeg=";
+    hash = "sha256-ZM8/1u4wIBHUgq2x8zyDJhf+qFQz4u5fhLNLaqAv/54=";
  };

  sourceRoot = "${src.name}/caddy";
@@ -18,29 +18,28 @@

 rustPlatform.buildRustPackage rec {
  pname = "gossip";
-  version = "0.9";
+  version = "0.11.3";

  src = fetchFromGitHub {
-    hash = "sha256-m0bIpalH12GK7ORcIk+UXwmBORMKXN5AUtdEogtkTRM=";
    owner = "mikedilger";
    repo = "gossip";
-    rev = version;
+    rev = "refs/tags/v${version}";
+    hash = "sha256-ZDpPoGLcI6ModRq0JEcibHerOrPOA3je1uE5yXsLeeg=";
  };

  cargoLock = {
    lockFile = ./Cargo.lock;
    outputHashes = {
-      "ecolor-0.23.0" = "sha256-Jg1oqxt6YNRbkoKqJoQ4uMhO9ncLUK18BGG0fa+7Bow=";
-      "egui-video-0.1.0" = "sha256-3483FErslfafCDVYx5qD6+amSkfVenMGMlEpPDnTT1M=";
-      "ffmpeg-next-6.0.0" = "sha256-EkzwR5alMjAubskPDGMP95YqB0CaC/HsKiGVRpKqUOE=";
-      "ffmpeg-sys-next-6.0.1" = "sha256-UiVKhrgVkROc25VSawxQymaJ0bAZ/dL0xMQErsP4KUU=";
-      "gossip-relay-picker-0.2.0-unstable" = "sha256-3rbjtpxNN168Al/5TM0caRLRd5mxLZun/qVhsGwS7wY=";
-      "heed-0.20.0-alpha.6" = "sha256-TFUC6SXNzNXfX18/RHFx7fq7O2le+wKcQl69Uv+CQkY=";
-      "nip44-0.1.0" = "sha256-of1bG7JuSdR19nXVTggHRUnyVDMlUrkqioyN237o3Oo=";
-      "nostr-types-0.7.0-unstable" = "sha256-B+hOZ4TRDSWgzyAc/yPiTWeU0fFCBPJG1XOHyoXfuQc=";
+      "ecolor-0.26.2" = "sha256-Ih1JbiuUZwK6rYWRSQcP1AJA8NesJJp+EeBtG0azlw0=";
+      "egui-video-0.1.0" = "sha256-X75gtYMfD/Ogepe0uEulzxAOY1YpkBW6OPhgovv/uCQ=";
+      "ffmpeg-next-7.0.2" = "sha256-LVdaCbPHHEolcrXk9tPxUJiPNCma7qRl53TPKFijhFA=";
+      "gossip-relay-picker-0.2.0-unstable" = "sha256-FUhB6ql+H+E6UffWmpwRFzP8N6x+dOX4vdtYdKItjz4=";
+      "lightning-0.0.123-beta" = "sha256-gngH0mOC9USzwUGP4bjb1foZAvg6QHuzODv7LG49MsA=";
+      "musig2-0.1.0" = "sha256-++1x7uHHR7KEhl8LF3VywooULiTzKeDu3e+0/c/8p9Y=";
+      "nip44-0.1.0" = "sha256-u2ALoHQrPVNoX0wjJmQ+BYRzIKsi0G5xPbYjgsNZZ7A=";
+      "nostr-types-0.8.0-unstable" = "sha256-HGXPJrI6+HT/oyAV3bELA0LPu4O0DmmJVr0mDtDVfr4=";
      "qrcode-0.12.0" = "sha256-onnoQuMf7faDa9wTGWo688xWbmujgE9RraBialyhyPw=";
-      "sdl2-0.35.2" = "sha256-qPId64Y6UkVkZJ+8xK645at5fv3mFcYaiInb0rGUfL4=";
-      "speedy-0.8.6" = "sha256-ltJQud1kEYkw7L2sZgPnD/teeXl2+FKgyX9kk2IC2Xg=";
+      "sdl2-0.36.0" = "sha256-dfXrD9LLBGeYyOLE3PruuGGBZ3WaPBfWlwBqP2pp+NY=";
    };
  };

@@ -26,7 +26,8 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  cmakeFlags = [
-    "-DBLASFEO_PATH=${blasfeo}"
+    "-DHPIPM_FIND_BLASFEO=ON"
+    "-DBUILD_SHARED_LIBS=ON"
  ] ++ lib.optionals (!stdenv.isx86_64) [ "-DTARGET=GENERIC" ];

  meta = {
@@ -8,16 +8,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "joshuto";
-  version = "0.9.8";
+  version = "0.9.8-unstable-2024-07-20";

  src = fetchFromGitHub {
    owner = "kamiyaa";
    repo = "joshuto";
-    rev = "v${version}";
-    hash = "sha256-8OvaL6HqsJjBAbksR4EpC/ZgvdBSKlB37PP77p3T3PY=";
+    rev = "d10ca32f8a2fea1afb6a5466b7dd29513066c996";
+    hash = "sha256-T5NfPPl8bAp3pcY1A7Dm37wC3+xrtYdoGEe4QOYgwUw=";
  };

-  cargoHash = "sha256-zGqOmebD7kZAsWunWSB2NFOSg0cu8aM1dyhEIQz1j4I=";
+  cargoHash = "sha256-YNdO4b4MegG3JVRFBt71RDXmPXYyksDtI0P740zxLso=";

  nativeBuildInputs = [ installShellFiles ];

@@ -26,11 +26,17 @@ stdenv.mkDerivation (finalAttrs: {
    })
  ];

-  postPatch = ''
-    # Compatibility with coin-or-mumps version
-    # https://github.com/coin-or-tools/ThirdParty-Mumps/blob/stable/3.0/get.Mumps#L66
-    cp libseq/mpi.h libseq/mumps_mpi.h
-  '';
+  postPatch =
+    ''
+      # Compatibility with coin-or-mumps version
+      # https://github.com/coin-or-tools/ThirdParty-Mumps/blob/stable/3.0/get.Mumps#L66
+      cp libseq/mpi.h libseq/mumps_mpi.h
+    ''
+    + lib.optionalString stdenv.isDarwin ''
+      substituteInPlace src/Makefile --replace-fail \
+        "-Wl,\''$(SONAME),libmumps_common" \
+        "-Wl,-install_name,$out/lib/libmumps_common"
+    '';

  configurePhase = ''
    cp Make.inc/Makefile.debian.SEQ ./Makefile.inc
@@ -67,11 +73,59 @@ stdenv.mkDerivation (finalAttrs: {
    scotch
  ];

+  preFixup = lib.optionalString stdenv.isDarwin ''
+    install_name_tool \
+      -change    libmpiseq.dylib \
+        $out/lib/libmpiseq.dylib \
+      -change    libpord.dylib \
+        $out/lib/libpord.dylib \
+        $out/lib/libmumps_common.dylib
+    install_name_tool \
+      -change    libmpiseq.dylib \
+        $out/lib/libmpiseq.dylib \
+      -change    libpord.dylib \
+        $out/lib/libpord.dylib \
+      -id \
+        $out/lib/libcmumps.dylib \
+        $out/lib/libcmumps.dylib
+    install_name_tool \
+      -change    libmpiseq.dylib \
+        $out/lib/libmpiseq.dylib \
+      -change    libpord.dylib \
+        $out/lib/libpord.dylib \
+      -id \
+        $out/lib/libdmumps.dylib \
+        $out/lib/libdmumps.dylib
+    install_name_tool \
+      -change    libmpiseq.dylib \
+        $out/lib/libmpiseq.dylib \
+      -change    libpord.dylib \
+        $out/lib/libpord.dylib \
+      -id \
+        $out/lib/libsmumps.dylib \
+        $out/lib/libsmumps.dylib
+    install_name_tool \
+      -change    libmpiseq.dylib \
+        $out/lib/libmpiseq.dylib \
+      -change    libpord.dylib \
+        $out/lib/libpord.dylib \
+      -id \
+        $out/lib/libzmumps.dylib \
+        $out/lib/libzmumps.dylib
+    install_name_tool \
+      -id \
+        $out/lib/libmpiseq.dylib \
+        $out/lib/libmpiseq.dylib
+    install_name_tool \
+      -id \
+        $out/lib/libpord.dylib \
+        $out/lib/libpord.dylib
+  '';
+
  meta = {
    description = "MUltifrontal Massively Parallel sparse direct Solver";
    homepage = "http://mumps-solver.org/";
    license = lib.licenses.cecill-c;
    maintainers = with lib.maintainers; [ nim65s ];
-    broken = stdenv.isDarwin;
  };
 })
@@ -61,11 +61,15 @@ stdenv.mkDerivation (finalAttrs: {
    "out"
  ];

-  cmakeFlags = [
-    (lib.cmakeBool "BUILD_DOCUMENTATION" true)
-    (lib.cmakeBool "INSTALL_DOCUMENTATION" true)
-    (lib.cmakeBool "BUILD_PYTHON_INTERFACE" pythonSupport)
-  ];
+  cmakeFlags =
+    [
+      (lib.cmakeBool "BUILD_DOCUMENTATION" true)
+      (lib.cmakeBool "INSTALL_DOCUMENTATION" true)
+      (lib.cmakeBool "BUILD_PYTHON_INTERFACE" pythonSupport)
+    ]
+    ++ lib.optionals (stdenv.hostPlatform.system == "aarch64-linux") [
+      "-DCMAKE_CTEST_ARGUMENTS=--exclude-regex;ProxQP::dense: test primal infeasibility solving"
+    ];

  strictDeps = true;

@@ -9,7 +9,7 @@
 }:

 rustPlatform.buildRustPackage rec {
-  pname = "rustic-rs";
+  pname = "rustic";
  version = "0.7.0";

  src = fetchFromGitHub {
@@ -19,7 +19,7 @@ rustPlatform.buildRustPackage rec {
    hash = "sha256-jUAmboJTzX4oJZy9rFiPRbm94bVpZGa0SaqotoCU/Ss=";
  };

-  cargoHash = "sha256-iZuWlYDGGziwb49BfKdt9Ahs6oQ0Ij2iiT0tvL7ZIVk=";
+  cargoHash = "sha256-8YGvxnwD9Vshah2jZ+XxOW0qB4nvWsOyLY1W8k+xQzU=";

  # At the time of writing, upstream defaults to "self-update" and "webdav".
  # "self-update" is a self-updater, which we don't want in nixpkgs.
@@ -5,14 +5,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "sploitscan";
-  version = "0.10.4";
+  version = "0.10.5";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "xaitax";
    repo = "SploitScan";
    rev = "refs/tags/v${version}";
-    hash = "sha256-6bC8mGzM6P0otzIG0+h0Koe9c+QI97HkEZh0HwfVviY=";
+    hash = "sha256-41NR31x/pJttBxv66t5g3s2PwlSBgsk0ybiH7xFs18k=";
  };

  pythonRelaxDeps = [
@@ -24,16 +24,16 @@

 rustPackages.rustPlatform.buildRustPackage rec {
  pname = "spotifyd";
-  version = "0.3.5-unstable-2024-07-10";
+  version = "0.3.5-unstable-2024-08-13";

  src = fetchFromGitHub {
    owner = "Spotifyd";
    repo = "spotifyd";
-    rev = "8fb0b9a5cce46d2e99e127881a04fb1986e58008";
-    hash = "sha256-wEPdf5ylnmu/SqoaWHxAzIEUpdRhhZfdQ623zYzcU+s=";
+    rev = "e342328550779423382f35cd10a18b1c76b81f40";
+    hash = "sha256-eP783ZNdzePQuhQE8SWYHwqK8J4+fperDYXAHWM0hz8=";
  };

-  cargoHash = "sha256-+xTmkp+hGzmz4XrfKqPCtlpsX8zLA8XgJWM1SPunjq4=";
+  cargoHash = "sha256-jmsfB96uWX4CzEsS2Grr2FCptMIebj2DSA5z6zG9AJg=";

  nativeBuildInputs = [ pkg-config ];

@@ -11,13 +11,13 @@

 rustPlatform.buildRustPackage rec {
  pname = "symbolicator";
-  version = "23.11.2";
+  version = "24.7.1";

  src = fetchFromGitHub {
    owner = "getsentry";
    repo = "symbolicator";
    rev = version;
-    hash = "sha256-pPzm57ZtsLLD7P0xIi+egKcQ3dcOGH6JV+C9u4uGGRM=";
+    hash = "sha256-thc1VXKtOc+kgIMHGDBp4InaSFG9mK9WYS7g90b5Fzs=";
    fetchSubmodules = true;
  };

@@ -25,7 +25,7 @@ rustPlatform.buildRustPackage rec {
    lockFile = ./Cargo.lock;
    outputHashes = {
      "cpp_demangle-0.4.1" = "sha256-9QopX2TOJc8bZ+UlSOFdjoe8NTJLVGrykyFL732tE3A=";
-      "reqwest-0.11.22" = "sha256-0IPpirvQSpwaF3bc5jh67UdJtKen3uumNgz5L4iqmYg=";
+      "reqwest-0.12.2" = "sha256-m46NyzsgXsDxb6zwVXP0wCdtCH+rb5f0x+oPNHuBF8s=";
    };
  };

@@ -5,12 +5,12 @@
 }:
 python3Packages.buildPythonApplication rec {
  pname = "terraform_local";
-  version = "0.18.2";
+  version = "0.19.0";
  pyproject = true;

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-8opiMd6ZxgWRJIDa0vhZJh5bmsO/CaHgGJ4sdEdxZLc=";
+    hash = "sha256-0E11eaEhz1pwP9MBVilqioj92fZP7wjLJcR4no79n9s=";
  };

  build-system = with python3Packages; [ setuptools ];
@@ -2,11 +2,11 @@

 buildGraalvmNativeImage rec {
  pname = "yamlscript";
-  version = "0.1.69";
+  version = "0.1.71";

  src = fetchurl {
    url = "https://github.com/yaml/yamlscript/releases/download/${version}/yamlscript.cli-${version}-standalone.jar";
-    hash = "sha256-Bw+TO9u0o+GHqVLPR7M4hFl1lMPa+tVDCeTEUoBBgcU=";
+    hash = "sha256-ko34trxTZmEkh/rltHLeweUg0deH7yiN6ME5igJiHHY=";
  };

  executable = "ys";
@@ -7,6 +7,7 @@ mkCoqDerivation rec {
  domain = "gitlab.inria.fr";
  inherit version;
  defaultVersion = with lib.versions; lib.switch coq.coq-version [
+    { case = range "8.13" "8.20"; out = "4.11.0"; }
    { case = range "8.12" "8.19"; out = "4.10.0"; }
    { case = range "8.12" "8.18"; out = "4.9.0"; }
    { case = range "8.12" "8.17"; out = "4.8.0"; }
@@ -16,6 +17,7 @@ mkCoqDerivation rec {
    { case = range "8.7" "8.11"; out = "3.4.2"; }
    { case = range "8.5" "8.6";  out = "3.3.0"; }
  ] null;
+  release."4.11.0".sha256 = "sha256-vPwa4zSjyvxHLGDoNaBnHV2pb77dnQFbC50BL80fcvE=";
  release."4.10.0".sha256 = "sha256-MZJVoKGLXjDabdv9BuUSK1L9z1cubzC9cqVuWevKIXQ=";
  release."4.9.0".sha256 = "sha256-+5NppyQahcc1idGu/U3B+EIWuZz2L3/oY7dIJR6pitE=";
  release."4.8.1".sha256 = "sha256-gknZ3bA90YY2AvwfFsP5iMhohwkQ8G96mH+4st2RPDc=";
@@ -9,13 +9,13 @@

 stdenv.mkDerivation rec {
  pname = "level-zero";
-  version = "1.17.19";
+  version = "1.17.25";

  src = fetchFromGitHub {
    owner = "oneapi-src";
    repo = "level-zero";
    rev = "refs/tags/v${version}";
-    hash = "sha256-WfnoYLBBXzYQ35Og6UgGFv6ebLMBos49JvJcZANRhd8=";
+    hash = "sha256-nC0Bp6Ggs5MDxBbrHVIh73LBb5yyMOUFuLXF06nvLkE=";
  };

  nativeBuildInputs = [ cmake addDriverRunpath ];
@@ -7,7 +7,7 @@
 , boost
 , eigen
 , example-robot-data
-, casadiSupport ? !stdenv.isDarwin
+, casadiSupport ? true
 , collisionSupport ? true
 , console-bridge
 , jrl-cmakemodules
@@ -1,15 +1,20 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fontconfig
 , gfortran
 , pkg-config
 , blas
 , bzip2
 , cbc
 , clp
+, doxygen
+, graphviz
 , ipopt
 , lapack
 , libamplsolver
+, osi
+, texliveSmall
 , zlib
 }:

@@ -27,8 +32,11 @@ stdenv.mkDerivation rec {
  };

  nativeBuildInputs = [
+    doxygen
    gfortran
+    graphviz
    pkg-config
+    texliveSmall
  ];
  buildInputs = [
    blas
@@ -38,17 +46,43 @@ stdenv.mkDerivation rec {
    ipopt
    lapack
    libamplsolver
+    osi
    zlib
  ];

-  meta = with lib; {
+  configureFlagsArray = lib.optionals stdenv.isDarwin [
+    "--with-asl-lib=-lipoptamplinterface -lamplsolver"
+  ];
+
+  # Fix doc install. Should not be necessary after next release
+  # ref https://github.com/coin-or/Bonmin/commit/4f665bc9e489a73cb867472be9aea518976ecd28
+  sourceRoot = "${src.name}/Bonmin";
+
+  # Fontconfig error: Cannot load default config file: No such file: (null)
+  env.FONTCONFIG_FILE = "${fontconfig.out}/etc/fonts/fonts.conf";
+
+  # Fontconfig error: No writable cache directories
+  preBuild = "export XDG_CACHE_HOME=$(mktemp -d)";
+
+  doCheck = true;
+  checkTarget = "test";
+
+  # ignore one failing test
+  postPatch = lib.optionalString stdenv.isDarwin ''
+    substituteInPlace test/Makefile.in --replace-fail \
+      "./unitTest\''$(EXEEXT)" \
+      ""
+  '';
+
+  # install documentation
+  postInstall = "make install-doxygen-docs";
+
+  meta = {
    description = "Open-source code for solving general MINLP (Mixed Integer NonLinear Programming) problems";
    mainProgram = "bonmin";
    homepage = "https://github.com/coin-or/Bonmin";
-    license = licenses.epl10;
-    platforms = platforms.unix;
-    maintainers = with maintainers; [ aanderse ];
-    # never built on aarch64-darwin, x86_64-darwin since first introduction in nixpkgs
-    broken = stdenv.isDarwin;
+    license = lib.licenses.epl10;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ aanderse ];
  };
 }
@@ -6,7 +6,7 @@
 , lapack
 , gfortran
 , enableAMPL ? true, libamplsolver
-, enableMUMPS ? !stdenv.isDarwin, mumps, mpi
+, enableMUMPS ? true, mumps, mpi
 , enableSPRAL ? true, spral
 }:

@@ -7,16 +7,16 @@
 (php.withExtensions ({ enabled, all }: enabled ++ (with all; [ ast ]))).buildComposerProject
  (finalAttrs: {
    pname = "phan";
-    version = "5.4.4";
+    version = "5.4.5";

    src = fetchFromGitHub {
      owner = "phan";
      repo = "phan";
      rev = finalAttrs.version;
-      hash = "sha256-9kHTDuCvh0qV6Av6uLD0t4vJO5XLL9dgRAgaREsV7zM=";
+      hash = "sha256-CSV+kapCzGOCBaYnX0lJVlDdZGNBCKZ/nogOac1xj1A=";
    };

-    vendorHash = "sha256-yE85MBseJa0VGV5EbjT0te4QT3697YvtumGkMMfZtxI=";
+    vendorHash = "sha256-qRcB0KmUJWRQaMlnK1JdUsZrikThD6nQnrqQZm9yROk=";

    meta = {
      description = "Static analyzer for PHP";
@@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "apsw";
-  version = "3.46.0.1";
+  version = "3.46.1.0";
  pyproject = true;

  disabled = pythonOlder "3.8";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
    owner = "rogerbinns";
    repo = "apsw";
    rev = "refs/tags/${version}";
-    hash = "sha256-GcfHkK4TCHPA2K6ymXtpCwNUCCUq0vq98UjYGGwn588=";
+    hash = "sha256-/MMCwdd2juFbv/lrYwuO2mdWm0+v+YFn6h9CwdQMTpg=";
  };

  build-system = [ setuptools ];
@@ -66,7 +66,7 @@ buildPythonPackage rec {
    owner = "iterative";
    repo = "dvc";
    rev = "refs/tags/${version}";
-    hash = "sha256-tC1Uv0EQZc0G4Eub98c/0mOp+haQPiQFGErQiRK0Gcw=";
+    hash = "sha256-5akMXeHpj7LXhUGxpKLgp4p9WDhRcRRfisILsS1f9kM=";
  };

  pythonRelaxDeps = [
@@ -34,12 +34,12 @@ let
 in
 buildPythonPackage rec {
  pname = "graph-tool";
-  version = "2.72";
+  version = "2.77";
  format = "other";

  src = fetchurl {
    url = "https://downloads.skewed.de/graph-tool/graph-tool-${version}.tar.bz2";
-    hash = "sha256-fInEzyauJPTjOU4XAR0TkIDbpAjli+rpzH++iztunHQ=";
+    hash = "sha256-mu/6r1Uo836ZTxuIL3UdsKvuUz+H1FZY9Y3ZbEBK0LQ=";
  };

  # Remove error messages about tput during build process without adding ncurses,
@@ -99,6 +99,6 @@ buildPythonPackage rec {
    homepage = "https://graph-tool.skewed.de";
    changelog = "https://git.skewed.de/count0/graph-tool/commits/release-${version}";
    license = lib.licenses.lgpl3Plus;
-    maintainers = [ ];
+    maintainers = [ lib.maintainers.mjoerg ];
  };
 }
@@ -32,7 +32,7 @@

 buildPythonPackage rec {
  pname = "imageio";
-  version = "2.34.2";
+  version = "2.35.0";
  pyproject = true;

  disabled = pythonOlder "3.8";
@@ -41,7 +41,7 @@ buildPythonPackage rec {
    owner = "imageio";
    repo = "imageio";
    rev = "refs/tags/v${version}";
-    hash = "sha256-1q/LPEdo9rzcIR1ZD+bIP8MIKe7PmxRd8UX6c5C0V5k=";
+    hash = "sha256-mmd3O7vvqKiHISASE5xRnBzuYon9HeEYRZGyDKy7n9o=";
  };

  patches = lib.optionals (!stdenv.isDarwin) [
@@ -58,7 +58,7 @@ buildPythonPackage rec {
    pillow
  ];

-  passthru.optional-dependencies = {
+  optional-dependencies = {
    bsdf = [ ];
    dicom = [ ];
    feisem = [ ];
@@ -79,14 +79,11 @@ buildPythonPackage rec {
    heif = [ pillow-heif ];
  };

-  nativeCheckInputs =
-    [
-      fsspec
-      psutil
-      pytestCheckHook
-    ]
-    ++ fsspec.optional-dependencies.github
-    ++ lib.flatten (builtins.attrValues passthru.optional-dependencies);
+  nativeCheckInputs = [
+    fsspec
+    psutil
+    pytestCheckHook
+  ] ++ fsspec.optional-dependencies.github ++ lib.flatten (builtins.attrValues optional-dependencies);

  pytestFlagsArray = [ "-m 'not needs_internet'" ];

@@ -26,12 +26,12 @@

 buildPythonPackage rec {
  pname = "keystoneauth1";
-  version = "5.6.0";
+  version = "5.7.0";
  pyproject = true;

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-7LfzR1nr4QPbNyqwlTwLghkp3dSX8zKqaz72yqz/7Yg=";
+    hash = "sha256-sswtaNGkjpwsbZsbH9ANfHvf4IboBAtR5wk4qLo639E=";
  };

  postPatch = ''
@@ -40,9 +40,9 @@ buildPythonPackage rec {
    rm test-requirements.txt
  '';

-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];

-  propagatedBuildInputs = [
+  dependencies = [
    betamax
    iso8601
    lxml
@@ -17,7 +17,7 @@

 buildPythonPackage rec {
  pname = "lacuscore";
-  version = "1.10.9";
+  version = "1.10.10";
  pyproject = true;

  disabled = pythonOlder "3.8";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
    owner = "ail-project";
    repo = "LacusCore";
    rev = "refs/tags/v${version}";
-    hash = "sha256-6DBfmojU9p0QAojYxFSciQkc8uvQtRw37Fc8Mp5Eu/8=";
+    hash = "sha256-FayFtkCV19fHlwsHIljVYEXJc8rxGZingfug3k2JCBM=";
  };

  pythonRelaxDeps = [
@@ -8,7 +8,7 @@

 buildPythonPackage rec {
  pname = "mitogen";
-  version = "0.3.8";
+  version = "0.3.9";
  pyproject = true;

  disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
    owner = "mitogen-hq";
    repo = "mitogen";
    rev = "refs/tags/v${version}";
-    hash = "sha256-6fuSmigLtNKrdOOSlmvPvzCIdFuvCuz/etNBXr5O0WQ=";
+    hash = "sha256-dfOufUvDsrBFvnz8/mp7iY9Tm52KoFFuQQnbq85qTGs=";
  };

  build-system = [ setuptools ];
@@ -7,34 +7,41 @@
  oslo-utils,
  openstacksdk,
  pbr,
+  pythonOlder,
  requests-mock,
-  simplejson,
+  setuptools,
+  requests,
  stestr,
 }:

 buildPythonPackage rec {
  pname = "osc-lib";
-  version = "2.8.0";
-  format = "setuptools";
+  version = "3.1.0";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";

  src = fetchFromGitHub {
    owner = "openstack";
    repo = "osc-lib";
    rev = version;
-    hash = "sha256-ijL/m9BTAgDUjqy77nkl3rDppeUPBycmEqlL6uMruIA=";
+    hash = "sha256-DDjWM4hjHPXYDeAJ6FDZZPzi65DG1rJ3efs8MouX1WY=";
  };

  # fake version to make pbr.packaging happy and not reject it...
  PBR_VERSION = version;

-  nativeBuildInputs = [ pbr ];
+  build-system = [
+    pbr
+    setuptools
+  ];

-  propagatedBuildInputs = [
+  dependencies = [
    cliff
    openstacksdk
    oslo-i18n
    oslo-utils
-    simplejson
+    requests
  ];

  nativeCheckInputs = [
@@ -9,19 +9,20 @@
  pyyaml,
  requests,
  rfc3986,
+  setuptools,
  stevedore,
  callPackage,
 }:

 buildPythonPackage rec {
  pname = "oslo-config";
-  version = "9.4.0";
-  format = "setuptools";
+  version = "9.5.0";
+  pyproject = true;

  src = fetchPypi {
    pname = "oslo.config";
    inherit version;
-    hash = "sha256-NbEaZhtgjttQMF2tkeTjCBnZDveUt9fbpb2LLvLrjA0=";
+    hash = "sha256-qlAARIhrbFX3ZXfLWpNJKkWWxfkoM3Z2DqeFLMScmaM=";
  };

  postPatch = ''
@@ -30,7 +31,9 @@ buildPythonPackage rec {
    rm test-requirements.txt
  '';

-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
    debtcollector
    netaddr
    oslo-i18n
@@ -14,22 +14,25 @@
  python-dateutil,
  pytestCheckHook,
  pythonOlder,
+  setuptools,
 }:

 buildPythonPackage rec {
  pname = "oslo-log";
-  version = "6.0.0";
-  format = "setuptools";
+  version = "6.1.1";
+  pyproject = true;

  disabled = pythonOlder "3.8";

  src = fetchPypi {
    pname = "oslo.log";
    inherit version;
-    hash = "sha256-ifDW+iy6goH4m1CKf+Sb+5far1XFJ4GH1FowaZceaH8=";
+    hash = "sha256-41oSz+TK0T/7Cu2pn8yiCnBdD2lKhMLvewe0WWD4j7Q=";
  };

-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
    oslo-config
    oslo-context
    oslo-serialization
@@ -13,9 +13,9 @@
  python-ironicclient,
  python-keystoneclient,
  python-manilaclient,
-  python-novaclient,
  python-openstackclient,
  requests-mock,
+  requests,
  setuptools,
  sphinxHook,
  sphinxcontrib-apidoc,
@@ -25,12 +25,12 @@

 buildPythonPackage rec {
  pname = "python-openstackclient";
-  version = "6.6.0";
+  version = "7.0.0";
  pyproject = true;

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-u+8e00gpxBBSsuyiZIDinKH3K+BY0UMNpTQexExPKVw=";
+    hash = "sha256-1HDjWYySnZI/12j9+Gb1G9NKkb+xfrcMoTY/q7aL0uA=";
  };

  build-system = [
@@ -47,7 +47,7 @@ buildPythonPackage rec {
    pbr
    python-cinderclient
    python-keystoneclient
-    python-novaclient
+    requests
  ];

  nativeCheckInputs = [
@@ -8,16 +8,16 @@

 buildGoModule rec {
  pname = "bearer";
-  version = "1.46.0";
+  version = "1.46.1";

  src = fetchFromGitHub {
    owner = "bearer";
    repo = "bearer";
    rev = "refs/tags/v${version}";
-    hash = "sha256-3zazf7dAw0dt+eZHirpKBQrB1BrOLCJokkvL3RxAdnw=";
+    hash = "sha256-zMQvD6ats1zJ/hK/aZh0LKWdSRqcR0BrAVcD4KnRwMQ=";
  };

-  vendorHash = "sha256-wlo8HZqbrBEcCzNms6PKNV7JjmwlL2vJ3bly12RrcB4=";
+  vendorHash = "sha256-1wxy/NXZCntVf8Po3Rn+pueadcveE0v3Jc0d4eYkY6s=";

  subPackages = [ "cmd/bearer" ];

@@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "go-tools";
-  version = "2023.1.7";
+  version = "2024.1";

  src = fetchFromGitHub {
    owner = "dominikh";
    repo = "go-tools";
    rev = version;
-    sha256 = "sha256-oR3fsvZmeddN75WsxOMcYe/RAIjYz+ba03ADJfDUqNg=";
+    sha256 = "sha256-uk2U8Jp/myJA6rmw+pk3DmmFLMqzfg8uudgTgc2Us5c=";
  };

-  vendorHash = "sha256-dUO2Iw+RYk8s+3IV2/TSKjaX61YkD/AROq3177r+wKE=";
+  vendorHash = "sha256-OZ67BWsIUaU24BPQ1VjbGE4GkDZUKgbBG3ynUVXvyaU=";

  excludedPackages = [ "website" ];

@@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "golangci-lint";
-  version = "1.59.1";
+  version = "1.60.1";

  src = fetchFromGitHub {
    owner = "golangci";
    repo = "golangci-lint";
    rev = "v${version}";
-    hash = "sha256-VFU/qGyKBMYr0wtHXyaMjS5fXKAHWe99wDZuSyH8opg=";
+    hash = "sha256-+F/t5UJjyqOsabi2J4M9g5JvAqfKjOvlzdhNozRCv70=";
  };

-  vendorHash = "sha256-yYwYISK1wM/mSlAcDSIwYRo8sRWgw2u+SsvgjH+Z/7M=";
+  vendorHash = "sha256-elDDSAeEpKXn6fhBFB218mWsSq0mo+GcfQsTDOAPSCI=";

  subPackages = [ "cmd/golangci-lint" ];

@@ -119,7 +119,7 @@ let

      NIX_PGLIBDIR="${postgresql}/lib" \
      PGRX_BUILD_FLAGS="--frozen -j $NIX_BUILD_CORES ${builtins.concatStringsSep " " cargoBuildFlags}" \
-      RUSTFLAGS="${lib.optionalString stdenv.isDarwin "-Clink-args=-Wl,-undefined,dynamic_lookup"}" \
+      ${lib.optionalString stdenv.isDarwin ''RUSTFLAGS="''${RUSTFLAGS:+''${RUSTFLAGS} }-Clink-args=-Wl,-undefined,dynamic_lookup"''} \
      cargo pgrx package \
        --pg-config ${postgresql}/bin/pg_config \
        ${maybeDebugFlag} \
@@ -1,11 +1,12 @@
-{ lib
-, stdenv
-, rustPlatform
-, fetchFromGitHub
-, ncurses
-, openssl
-, pkg-config
-, Security
+{
+  lib,
+  stdenv,
+  rustPlatform,
+  fetchFromGitHub,
+  ncurses,
+  openssl,
+  pkg-config,
+  Security,
 }:

 rustPlatform.buildRustPackage rec {
@@ -14,30 +15,34 @@ rustPlatform.buildRustPackage rec {

  src = fetchFromGitHub {
    owner = "Builditluc";
-    repo = pname;
+    repo = "wiki-tui";
    rev = "v${version}";
    hash = "sha256-euyg4wYWYerYT3hKdOCjokx8lJldGN7E3PHimDgQy3U=";
  };

-  nativeBuildInputs = [
-    pkg-config
-  ];
+  # Note: bump `time` dependency to be able to build with rust 1.80, should be removed on the next
+  # release (see: https://github.com/NixOS/nixpkgs/issues/332957)
+  cargoPatches = [ ./time.patch ];
+
+  nativeBuildInputs = [ pkg-config ];

  buildInputs = [
    ncurses
    openssl
-  ] ++ lib.optionals stdenv.isDarwin [
-    Security
-  ];
+  ] ++ lib.optionals stdenv.isDarwin [ Security ];

-  cargoHash = "sha256-rKTR7vKt8woWAn7XgNYFiWu4KSiZYhaH+PLEIOfbNIY=";
+  cargoHash = "sha256-XovbT+KC0va7yC5j7kf6t1SnXe1uyy1KI8FRV1AwkS0=";

  meta = with lib; {
    description = "Simple and easy to use Wikipedia Text User Interface";
    homepage = "https://github.com/builditluc/wiki-tui";
    changelog = "https://github.com/Builditluc/wiki-tui/releases/tag/v${version}";
    license = licenses.mit;
-    maintainers = with maintainers; [ lom builditluc matthiasbeyer ];
+    maintainers = with maintainers; [
+      lom
+      builditluc
+      matthiasbeyer
+    ];
    mainProgram = "wiki-tui";
  };
 }
@@ -0,0 +1,211 @@
+diff --git a/Cargo.lock b/Cargo.lock
+index e66f0ac..918c3b2 100644
+--- a/Cargo.lock
+++ b/Cargo.lock
+@@ -318,7 +318,7 @@ dependencies = [
+  "log",
+  "num",
+  "owning_ref",
+- "time 0.3.22",
+ "time 0.3.36",
+  "unicode-segmentation",
+  "unicode-width",
+  "xi-unicode",
+@@ -344,7 +344,7 @@ dependencies = [
+  "ident_case",
+  "proc-macro2",
+  "quote",
+- "syn 2.0.23",
+ "syn 2.0.32",
+ ]
+ 
+ [[package]]
+@@ -355,7 +355,16 @@ checksum = "29a358ff9f12ec09c3e61fef9b5a9902623a695a46a917b07f269bff1445611a"
+ dependencies = [
+  "darling_core",
+  "quote",
+- "syn 2.0.23",
+ "syn 2.0.32",
+]
+
+[[package]]
+name = "deranged"
+version = "0.3.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b42b6fa04a440b495c8b04d0e71b707c585f83cb9cb28cf8cd0d976c315e31b4"
+dependencies = [
+ "powerfmt",
+ ]
+ 
+ [[package]]
+@@ -427,7 +436,7 @@ checksum = "8560b409800a72d2d7860f8e5f4e0b0bd22bea6a352ea2a9ce30ccdef7f16d2f"
+ dependencies = [
+  "proc-macro2",
+  "quote",
+- "syn 2.0.23",
+ "syn 2.0.32",
+ ]
+ 
+ [[package]]
+@@ -448,7 +457,7 @@ dependencies = [
+  "darling",
+  "proc-macro2",
+  "quote",
+- "syn 2.0.23",
+ "syn 2.0.32",
+ ]
+ 
+ [[package]]
+@@ -1025,6 +1034,12 @@ dependencies = [
+  "num-traits",
+ ]
+ 
+[[package]]
+name = "num-conv"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"
+
+ [[package]]
+ name = "num-integer"
+ version = "0.1.45"
+@@ -1129,7 +1144,7 @@ checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
+ dependencies = [
+  "proc-macro2",
+  "quote",
+- "syn 2.0.23",
+ "syn 2.0.32",
+ ]
+ 
+ [[package]]
+@@ -1282,6 +1297,12 @@ version = "0.3.27"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "26072860ba924cbfa98ea39c8c19b4dd6a4a25423dbdf219c1eca91aa0cf6964"
+ 
+[[package]]
+name = "powerfmt"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
+
+ [[package]]
+ name = "ppv-lite86"
+ version = "0.2.17"
+@@ -1518,9 +1539,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "serde"
+-version = "1.0.167"
+version = "1.0.193"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "7daf513456463b42aa1d94cff7e0c24d682b429f020b9afa4f5ba5c40a22b237"
+checksum = "25dd9975e68d0cb5aa1120c288333fc98731bd1dd12f561e468ea4728c042b89"
+ dependencies = [
+  "serde_derive",
+ ]
+@@ -1537,13 +1558,13 @@ dependencies = [
+ 
+ [[package]]
+ name = "serde_derive"
+-version = "1.0.167"
+version = "1.0.193"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "b69b106b68bc8054f0e974e70d19984040f8a5cf9215ca82626ea4853f82c4b9"
+checksum = "43576ca501357b9b071ac53cdc7da8ef0cbd9493d8df094cd821777ea6e894d3"
+ dependencies = [
+  "proc-macro2",
+  "quote",
+- "syn 2.0.23",
+ "syn 2.0.32",
+ ]
+ 
+ [[package]]
+@@ -1565,7 +1586,7 @@ checksum = "1d89a8107374290037607734c0b73a85db7ed80cae314b3c5791f192a496e731"
+ dependencies = [
+  "proc-macro2",
+  "quote",
+- "syn 2.0.23",
+ "syn 2.0.32",
+ ]
+ 
+ [[package]]
+@@ -1750,9 +1771,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "syn"
+-version = "2.0.23"
+version = "2.0.32"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "59fb7d6d8281a51045d62b8eb3a7d1ce347b76f312af50cd3dc0af39c87c1737"
+checksum = "239814284fd6f1a4ffe4ca893952cdd93c224b6a1571c9a9eadd670295c0c9e2"
+ dependencies = [
+  "proc-macro2",
+  "quote",
+@@ -1832,7 +1853,7 @@ checksum = "463fe12d7993d3b327787537ce8dd4dfa058de32fc2b195ef3cde03dc4771e8f"
+ dependencies = [
+  "proc-macro2",
+  "quote",
+- "syn 2.0.23",
+ "syn 2.0.32",
+ ]
+ 
+ [[package]]
+@@ -1859,13 +1880,16 @@ dependencies = [
+ 
+ [[package]]
+ name = "time"
+-version = "0.3.22"
+version = "0.3.36"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "ea9e1b3cf1243ae005d9e74085d4d542f3125458f3a81af210d901dcd7411efd"
+checksum = "5dfd88e563464686c916c7e46e623e520ddc6d79fa6641390f2e3fa86e83e885"
+ dependencies = [
+ "deranged",
+  "itoa",
+  "libc",
+ "num-conv",
+  "num_threads",
+ "powerfmt",
+  "serde",
+  "time-core",
+  "time-macros",
+@@ -1873,16 +1897,17 @@ dependencies = [
+ 
+ [[package]]
+ name = "time-core"
+-version = "0.1.1"
+version = "0.1.2"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "7300fbefb4dadc1af235a9cef3737cea692a9d97e1b9cbcd4ebdae6f8868e6fb"
+checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3"
+ 
+ [[package]]
+ name = "time-macros"
+-version = "0.2.9"
+version = "0.2.18"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "372950940a5f07bf38dbe211d7283c9e6d7327df53794992d293e534c733d09b"
+checksum = "3f252a68540fde3a3877aeea552b832b40ab9a69e318efd078774a01ddee1ccf"
+ dependencies = [
+ "num-conv",
+  "time-core",
+ ]
+ 
+@@ -2133,7 +2158,7 @@ dependencies = [
+  "once_cell",
+  "proc-macro2",
+  "quote",
+- "syn 2.0.23",
+ "syn 2.0.32",
+  "wasm-bindgen-shared",
+ ]
+ 
+@@ -2167,7 +2192,7 @@ checksum = "54681b18a46765f095758388f2d0cf16eb8d4169b639ab575a8f5693af210c7b"
+ dependencies = [
+  "proc-macro2",
+  "quote",
+- "syn 2.0.23",
+ "syn 2.0.32",
+  "wasm-bindgen-backend",
+  "wasm-bindgen-shared",
+ ]
@@ -1,14 +1,16 @@
 { lib, stdenv, fetchFromGitHub, kernel, kmod }:

-stdenv.mkDerivation {
+let version = "0.13.2";
+
+in stdenv.mkDerivation {
  pname = "v4l2loopback";
-  version = "0.12.7-unstable-2024-02-12-${kernel.version}";
+  version = "${version}-${kernel.version}";

  src = fetchFromGitHub {
    owner = "umlaeute";
    repo = "v4l2loopback";
-    rev = "5d72c17f92ee0e38efbb7eb85e34443ecbf1a80c";
-    hash = "sha256-ggmYH5MUXhMPvA8UZ2EAG+eGoPTNbw7B8UxmmgP6CsE=";
+    rev = "v${version}";
+    hash = "sha256-rcwgOXnhRPTmNKUppupfe/2qNUBDUqVb3TeDbrP5pnU=";
  };

  hardeningDisable = [ "format" "pic" ];
@@ -8,11 +8,11 @@

 buildGoModule rec {
  pname = "honk";
-  version = "1.3.1";
+  version = "1.4.1";

  src = fetchurl {
    url = "https://humungus.tedunangst.com/r/honk/d/honk-${version}.tgz";
-    hash = "sha256-F4Hz36nvcZv8MTh7a9Zr73kEBTS0c16Xty3T6/EzJeI=";
+    hash = "sha256-o9K/ht31nEbx2JmLG3OSIgKZGygpDhZYqCxs6tuSnlc=";
  };
  vendorHash = null;

@@ -27,10 +27,10 @@ buildGoModule rec {
  subPackages = [ "." ];

  # This susbtitution is not mandatory. It is only existing to have something
-  # working out of the box. This value can be overriden by the user, by
+  # working out of the box. This value can be overridden by the user, by
  # providing the `-viewdir` parameter in the command line.
  postPatch = ''
-    substituteInPlace main.go --replace \
+    substituteInPlace main.go --replace-fail \
      "var viewDir = \".\"" \
      "var viewDir = \"$out/share/honk\""
  '';
@@ -1,70 +1,66 @@
-{ buildGoModule
-, cargo
-, cmake
-, fetchFromGitHub
-, go
-, lib
-, libcap
-, libgcrypt
-, libgpg-error
-, libsecret
-, pkg-config
-, polkit
-, python3
-, qt5compat
-, qtbase
-, qtnetworkauth
-, qtsvg
-, qttools
-, qtwayland
-, qtwebsockets
-, rustPlatform
-, rustc
-, stdenv
-, wireguard-tools
-, wrapQtAppsHook
+{
+  buildGoModule,
+  cargo,
+  cmake,
+  fetchFromGitHub,
+  fetchpatch,
+  go,
+  lib,
+  libcap,
+  libgcrypt,
+  libgpg-error,
+  libsecret,
+  pkg-config,
+  polkit,
+  python3,
+  qt5compat,
+  qtbase,
+  qtnetworkauth,
+  qtsvg,
+  qttools,
+  qtwayland,
+  qtwebsockets,
+  rustPlatform,
+  rustc,
+  stdenv,
+  wireguard-tools,
+  wrapQtAppsHook,
 }:

-let
+stdenv.mkDerivation (finalAttrs: {
  pname = "mozillavpn";
-  version = "2.21.0";
+  version = "2.23.1";
  src = fetchFromGitHub {
    owner = "mozilla-mobile";
    repo = "mozilla-vpn-client";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
    fetchSubmodules = true;
-    hash = "sha256-XBvKSgMuWgMuV+is2G028UNQ4hID7tKiHFuMdPOZcsI=";
+    hash = "sha256-NQM1ZII9owD9ek/Leo6WRfvNybZ5pUjDgvQGXQBrD+0=";
  };
-  patches = [ ];
+  patches = [
+    # Update cargo deps for "time"
+    (fetchpatch {
+      url = "https://github.com/mozilla-mobile/mozilla-vpn-client/commit/31d5799a30fc02067ad31d86b6ef63294bb3c3b8.patch";
+      hash = "sha256-ECrIcfhhSuvbqQ/ExPdFkQ6b9Q767lhUKmwPdDz7yxI=";
+    })
+  ];

-  netfilterGoModules = (buildGoModule {
-    inherit pname version src patches;
-    modRoot = "linux/netfilter";
-    vendorHash = "sha256-Cmo0wnl0z5r1paaEf1MhCPbInWeoMhGjnxCxGh0cyO8=";
-  }).goModules;
+  netfilterGoModules =
+    (buildGoModule {
+      inherit (finalAttrs)
+        pname
+        version
+        src
+        patches
+        ;
+      modRoot = "linux/netfilter";
+      vendorHash = "sha256-Cmo0wnl0z5r1paaEf1MhCPbInWeoMhGjnxCxGh0cyO8=";
+    }).goModules;

-  extensionBridgeDeps = rustPlatform.fetchCargoTarball {
-    inherit src patches;
-    name = "${pname}-${version}-extension-bridge";
-    preBuild = "cd extension/bridge";
-    hash = "sha256-1BXlp9AC9oQo/UzCtgNWVv8Er2ERoDLKdlTYXLzodMQ=";
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit (finalAttrs) src patches;
+    hash = "sha256-JIe6FQL0xm6FYYGoIwwnOxq21sC1y8xPsr8tYPF0Mzo=";
  };
-  signatureDeps = rustPlatform.fetchCargoTarball {
-    inherit src patches;
-    name = "${pname}-${version}-signature";
-    preBuild = "cd signature";
-    hash = "sha256-GtkDkeFdPsLuTpZh5UqIhFMpzW3HMkbz7npryOQkkGw=";
-  };
-  qtgleanDeps = rustPlatform.fetchCargoTarball {
-    inherit src patches;
-    name = "${pname}-${version}-qtglean";
-    preBuild = "cd qtglean";
-    hash = "sha256-HFmRcfxCcc83IPPIovbf3jNftp0olKQ6RzV8vPpCYAM=";
-  };
-
-in
-stdenv.mkDerivation {
-  inherit pname version src patches;

  buildInputs = [
    libcap
@@ -93,24 +89,6 @@ stdenv.mkDerivation {
    wrapQtAppsHook
  ];

-  postUnpack = ''
-    pushd source/extension/bridge
-    cargoDeps='${extensionBridgeDeps}' cargoSetupPostUnpackHook
-    extensionBridgeDepsCopy="$cargoDepsCopy"
-    popd
-
-    pushd source/signature
-    cargoDeps='${signatureDeps}' cargoSetupPostUnpackHook
-    signatureDepsCopy="$cargoDepsCopy"
-    popd
-
-    pushd source/qtglean
-    cargoDeps='${qtgleanDeps}' cargoSetupPostUnpackHook
-    qtgleanDepsCopy="$cargoDepsCopy"
-    popd
-  '';
-  dontCargoSetupPostUnpack = true;
-
  postPatch = ''
    substituteInPlace src/cmake/linux.cmake \
      --replace '/etc/xdg/autostart' "$out/etc/xdg/autostart" \
@@ -120,21 +98,7 @@ stdenv.mkDerivation {
    substituteInPlace extension/CMakeLists.txt \
      --replace '/etc' "$out/etc"

-    ln -s '${netfilterGoModules}' linux/netfilter/vendor
-
-    pushd extension/bridge
-    cargoDepsCopy="$extensionBridgeDepsCopy" cargoSetupPostPatchHook
-    popd
-
-    pushd signature
-    cargoDepsCopy="$signatureDepsCopy" cargoSetupPostPatchHook
-    popd
-
-    pushd qtglean
-    cargoDepsCopy="$qtgleanDepsCopy" cargoSetupPostPatchHook
-    popd
-
-    cargoSetupPostPatchHook() { true; }
+    ln -s '${finalAttrs.netfilterGoModules}' linux/netfilter/vendor
  '';

  cmakeFlags = [
@@ -144,8 +108,12 @@ stdenv.mkDerivation {
  ];
  dontFixCmake = true;

-  qtWrapperArgs =
-    [ "--prefix" "PATH" ":" (lib.makeBinPath [ wireguard-tools ]) ];
+  qtWrapperArgs = [
+    "--prefix"
+    "PATH"
+    ":"
+    (lib.makeBinPath [ wireguard-tools ])
+  ];

  meta = {
    description = "Client for the Mozilla VPN service";
@@ -155,4 +123,4 @@ stdenv.mkDerivation {
    maintainers = with lib.maintainers; [ andersk ];
    platforms = lib.platforms.linux;
  };
-}
+})
@@ -13,7 +13,7 @@

 let
  pname = "ockam";
-  version = "0.130.0";
+  version = "0.132.0";
 in
 rustPlatform.buildRustPackage {
  inherit pname version;
@@ -22,10 +22,10 @@ rustPlatform.buildRustPackage {
    owner = "build-trust";
    repo = pname;
    rev = "ockam_v${version}";
-    hash = "sha256-k64EiISQMGtXcgB5iqkq+hPLfLGIS3ma2vyGedkCHsg=";
+    hash = "sha256-ynlXQoOTvfSWCL1BqvIjJYYUDGmjDa0HaN3L8I6p/7Q=";
  };

-  cargoHash = "sha256-qWfAGzWCPiFgxhbfUoar81jrRJMlOrZT7h/PJI9yz9Y=";
+  cargoHash = "sha256-yOSCkOIprQoAGxPi1jsHPmQ9bVaudSNw13jL4jTNehY=";
  nativeBuildInputs = [ git pkg-config ];
  buildInputs = [ openssl dbus ]
    ++ lib.optionals stdenv.isDarwin [ AppKit Security ];
@@ -25,16 +25,16 @@ in

 rustPlatform.buildRustPackage rec {
  pname = "nix-init";
-  version = "0.3.0";
+  version = "0.3.1";

  src = fetchFromGitHub {
    owner = "nix-community";
    repo = "nix-init";
    rev = "v${version}";
-    hash = "sha256-YUstBO+iznr0eJYVJdNQ2BjDhvviRQuojhT9IlTuR0k=";
+    hash = "sha256-PeOYYTSqqi/KSp+QjMbnNRQqKENo/zemN5Bpqiyh0vA=";
  };

-  cargoHash = "sha256-OAgEzf+EyrwjNa40BwPwSNZ4lhEH93YxCbPJJ3r7oSQ=";
+  cargoHash = "sha256-YRScCgmrCjzSZWHvnaBTCJsT02gd4SToz130zOMQ+VY=";

  nativeBuildInputs = [
    curl
@@ -0,0 +1,66 @@
+From 472d60ff5d0f7e1cbfe4ec92cf7e985eefb68a92 Mon Sep 17 00:00:00 2001
+From: Bryan Lai <bryanlais@gmail.com>
+Date: Wed, 14 Aug 2024 14:23:10 +0800
+Subject: [PATCH] deps: bump `time`, fix build for rust 1.80
+
+---
+ Cargo.lock | 22 ++++++++++++++++------
+ 1 file changed, 16 insertions(+), 6 deletions(-)
+
+diff --git a/Cargo.lock b/Cargo.lock
+index 5bd0f35..dabe0d1 100644
+--- a/Cargo.lock
+++ b/Cargo.lock
+@@ -372,6 +372,15 @@ dependencies = [
+  "syn 1.0.109",
+ ]
+ 
+[[package]]
+name = "deranged"
+version = "0.3.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b42b6fa04a440b495c8b04d0e71b707c585f83cb9cb28cf8cd0d976c315e31b4"
+dependencies = [
+ "serde",
+]
+
+ [[package]]
+ name = "errno"
+ version = "0.3.1"
+@@ -1041,10 +1050,11 @@ dependencies = [
+ 
+ [[package]]
+ name = "time"
+-version = "0.3.20"
+version = "0.3.26"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "cd0cbfecb4d19b5ea75bb31ad904eb5b9fa13f21079c3b92017ebdf4999a5890"
+checksum = "a79d09ac6b08c1ab3906a2f7cc2e81a0e27c7ae89c63812df75e52bef0751e07"
+ dependencies = [
+ "deranged",
+  "itoa",
+  "libc",
+  "num_threads",
+@@ -1055,15 +1065,15 @@ dependencies = [
+ 
+ [[package]]
+ name = "time-core"
+-version = "0.1.0"
+version = "0.1.1"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "2e153e1f1acaef8acc537e68b44906d2db6436e2b35ac2c6b42640fff91f00fd"
+checksum = "7300fbefb4dadc1af235a9cef3737cea692a9d97e1b9cbcd4ebdae6f8868e6fb"
+ 
+ [[package]]
+ name = "time-macros"
+-version = "0.2.8"
+version = "0.2.12"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "fd80a657e71da814b8e5d60d3374fc6d35045062245d80224748ae522dd76f36"
+checksum = "75c65469ed6b3a4809d987a41eb1dc918e9bc1d92211cbad7ae82931846f7451"
+ dependencies = [
+  "time-core",
+ ]
+-- 
+2.45.2
+
@@ -15,7 +15,11 @@ rustPlatform.buildRustPackage rec {
    hash = "sha256-5V9sPbBb9t4B6yiLrYF+hx6YokGDH6+UsVQBhgqxMbY=";
  };

-  cargoHash = "sha256-yBoaLqynvYC9ebC0zjd2FmSSd53xzn4ralihtCFubAw=";
+  cargoPatches = [
+    ./0001-fix-build-for-rust-1.80.patch
+  ];
+
+  cargoHash = "sha256-SzBsSr8bpzhc0GIcTkm9LZgJ66LEBe3QA8I7NdaJ0T8=";

  nativeBuildInputs = [
    installShellFiles
@@ -9,14 +9,14 @@

 buildPythonPackage rec {
  pname = "poetry-plugin-up";
-  version = "0.7.2";
+  version = "0.7.3";
  format = "pyproject";

  src = fetchFromGitHub {
    owner = "MousaZeidBaker";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-O82oFEU67o0bZVBtkEZsOLtLBkuLHglr/4+Hkd/8Lvc=";
+    hash = "sha256-yhGoiuqPUzEPiq+zO/RD4pB1LvOo80yLIpM+rRQHOmY=";
  };

  nativeBuildInputs = [
@@ -2,42 +2,17 @@

 stdenv.mkDerivation rec {
  pname = "efivar";
-  version = "38";
+  version = "39";

  outputs = [ "bin" "out" "dev" "man" ];

  src = fetchFromGitHub {
-    owner = "rhinstaller";
+    owner = "rhboot";
    repo = "efivar";
    rev = version;
-    hash = "sha256-A38BKGMK3Vo+85wzgxmzTjzZXtpcY9OpbZaONWnMYNk=";
+    hash = "sha256-s/1k5a3n33iLmSpKQT5u08xoj8ypjf2Vzln88OBrqf0=";
  };

-  patches = [
-    (fetchpatch {
-      url = "https://github.com/rhboot/efivar/commit/15622b7e5761f3dde3f0e42081380b2b41639a48.patch";
-      sha256 = "sha256-SjZXj0hA2eQu2MfBoNjFPtd2DMYadtL7ZqwjKSf2cmI=";
-    })
-    # src/Makefile: build util.c separately for makeguids
-    # util.c needs to be built twice when cross-compiling
-    (fetchpatch {
-      url = "https://github.com/rhboot/efivar/commit/ca48d3964d26f5e3b38d73655f19b1836b16bd2d.patch";
-      hash = "sha256-DkNFIK4i7Eypyf2UeK7qHW36N2FSVRJ2rnOVLriWi5c=";
-    })
-    (fetchpatch {
-      name = "musl-backport.patch";
-      url = "https://github.com/rhboot/efivar/commit/cece3ffd5be2f8641eb694513f2b73e5eb97ffd3.patch";
-      sha256 = "7/E0gboU0A45/BY6jGPLuvds6qKtNjzpgKgdNTaVaZQ=";
-    })
-
-    # Fix build against gcc-13: https://github.com/rhboot/efivar/pull/242
-    (fetchpatch {
-      name = "gcc-13.patch";
-      url = "https://github.com/rhboot/efivar/commit/52fece47d4f3ebd588bd85598bfc7a0142365f7e.patch";
-      hash = "sha256-tOmxbY7kD6kzbBZ2RhQ5gCCpHtu+2gRNa7VUAWdCKu0=";
-    })
-  ];
-
  nativeBuildInputs = [ pkg-config mandoc ];
  buildInputs = [ popt ];
  depsBuildBuild = [ buildPackages.stdenv.cc ];
@@ -1318,6 +1318,7 @@ mapAliases ({
  runCommandNoCC = runCommand;
  runCommandNoCCLocal = runCommandLocal;
  rustc-wasm32 = rustc; # Added 2023-12-01
+  rustic-rs = rustic; # Added 2024-08-02
  rxvt_unicode = rxvt-unicode-unwrapped; # Added 2020-02-02
  rxvt_unicode-with-plugins = rxvt-unicode; # Added 2020-02-02

@@ -25873,7 +25873,7 @@ with pkgs;

  roon-server = callPackage ../servers/roon-server { };

-  rustic-rs = callPackage ../tools/backup/rustic-rs {
+  rustic = callPackage ../by-name/ru/rustic/package.nix {
    inherit (darwin.apple_sdk.frameworks) Security SystemConfiguration;
  };

@@ -36836,7 +36836,9 @@ with pkgs;

  pdb2pqr = with python3Packages; toPythonApplication pdb2pqr;

-  pymol = callPackage ../applications/science/chemistry/pymol { };
+  pymol = callPackage ../applications/science/chemistry/pymol {
+    python3Packages = python311Packages;
+  };

  quantum-espresso = callPackage ../applications/science/chemistry/quantum-espresso {
    hdf5 = hdf5-fortran;